EUVD-2026-91939
GHSA-5m3g-q793-wg8x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated REST API access with no interaction (AV:N/AC:L/PR:N/UI:N); limited to disclosure of submitter data so C:L and I:N/A:N, no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
AnalysisAI
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data through the plugin's REST API, allowing anyone who can reach the site's REST endpoints to read submitter information without logging in. Exploitation is trivial - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low complexity, no authentication and no user interaction - and publicly available exploit code exists, though there is no indication of confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.14% (3rd percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond having the vulnerable component active - exploitation requires only that a WordPress site runs MetForm before 4.3.1 with the form-submission REST API reachable (default behavior), and that forms contain stored submission data to disclose. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity information disclosure issue, not a critical priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 4.3.1 - upgrade the MetForm plugin to version 4.3.1 or later as the primary fix, which restores the missing access restrictions on the form-submission REST API (WPScan advisory: https://wpscan.com/vulnerability/d73e4c95-471b-4f22-97a0-b6a59f187bcd/; related records at https://nvd.nist.gov/vuln/detail/CVE-2026-86832 and https://vuldb.com/vuln/413297). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-fie
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies -
Stored cross-site scripting in the Wpmet Metform WordPress plugin (versions through 4.3.0) lets a low-privilege authenti
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today