EUVD-2026-37665Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running MetForm Pro ≤3.9.1
-
DeliveryLocate unauthenticated plugin endpoint
-
ExploitSend crafted HTTP request bypassing authorization
-
ExecutionRetrieve form data or disrupt service
-
ImpactConfidentiality and availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Required conditions: the target WordPress site must have the MetForm Pro plugin installed and activated at version 3.9.1 or earlier, and the vulnerable plugin endpoint(s) must be reachable over HTTP/HTTPS from the attacker (default WordPress deployments expose /wp-json and /wp-admin/admin-ajax.php to the internet). No authentication, no user interaction, and no special configuration are required (PR:N/UI:N/AC:L). Limiting factors: sites that have already upgraded past 3.9.1, sites that block public access to /wp-json or admin-ajax via WAF/firewall, and sites where MetForm Pro is deactivated are not exploitable; the free MetForm plugin (non-Pro) is not in the listed CPE and is out of scope based on the available data. |
| Impact | Signals are mixed: the CVSS 9.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) describes remote, unauthenticated, low-complexity exploitation with high confidentiality and availability impact and no integrity impact, which is consistent with leaking submitted form data and/or causing denial of service on the plugin's backend, but the published description is a single line and does not name the specific vulnerable endpoint. The vulnerability is not listed on CISA KEV, no EPSS score was provided in the input, and no public exploit identified at time of analysis, so prioritization should rest on CVSS plus the plugin's install base on WordPress sites. Notable gap: the CVSS sets I:N (no integrity impact), yet 'broken access control' in form plugins often does enable record tampering - this discrepancy should be verified against the Patchstack advisory before excluding integrity-driven scenarios. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates WordPress sites running MetForm Pro <= 3.9.1, then sends crafted HTTP requests directly to the plugin's exposed REST or admin-ajax endpoints that lack authorization checks. Because the action runs without verifying capability, the attacker retrieves sensitive form submission data or triggers a backend operation that disrupts availability of the form/site, all without credentials and at low complexity per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated broken access control in WPMET MetForm Pro WordPress plugin versions 3.9.1 and earlier allows remote attackers to access protected functionality without credentials, with CVSS 9.1 reflecting high confidentiality and availability impact. Reported by Patchstack, the flaw stems from missing authorization (CWE-862) on plugin endpoints, and no public exploit identified at time of analysis.
RemediationAI
Patch status from the available data is ambiguous - the Patchstack record covers '<= 3.9.1', which typically implies a fixed version above 3.9.1, but no exact fix version is provided in this input, so treat this as 'Patch available per vendor advisory' and confirm the exact fixed release at https://patchstack.com/database/wordpress/plugin/metform-pro/vulnerability/wordpress-metform-pro-plugin-3-9-1-broken-access-control-vulnerability-2 before deploying. Upgrade MetForm Pro to the latest version published by Wpmet that is strictly greater than 3.9.1; until then, consider deactivating MetForm Pro on sites that do not actively need it (side effect: any pages relying on its forms will break), or place the site behind a WAF rule that blocks unauthenticated requests to MetForm Pro's REST routes and admin-ajax actions (side effect: legitimate front-end form submissions from anonymous users may also be blocked and need allow-listing).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MetForm Pro is a premium WordPress form-builder plugin by Wpmet, typically used with Elementor to build contact, registration, and payment forms; the affected CPE is cpe:2.3:a:wpmet:metform_pro covering all versions up to and including 3.9.1. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin actions (likely AJAX handlers or REST routes registered by the plugin) execute privileged logic without verifying the caller's capability or nonce. In WordPress plugins this class of flaw typically appears when register_rest_route() omits a permission_callback or when admin-ajax actions skip current_user_can() and check_ajax_referer() checks, exposing form submission data, form configuration, or backend integrations to anonymous callers.
Know when Metform Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Plugin endpoint is network-reachable with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); broken access control on form data yields C:H and A:H, with I:N retained per vendor scoring.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.
Executive ViewAI
WPMET MetForm Pro (versions 3.9.1 and earlier) contains a critical unauthenticated access control vulnerability allowing attackers to bypass authorization and access protected form functionality without credentials. Any WordPress site using this plugin-a common form-builder tool-faces immediate risk of unauthorized data exposure. Leadership should prioritize immediate inventory and disable non-essential instances pending vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable plugin on non-critical systems; (2) Implement Web Application Firewall (WAF) rules to block unauthenticated requests to affected plugin endpoints; (3) Restrict MetForm Pro access to authenticated users via web server or WordPress security plugin configuration; (4) Enable logging and alerting for unauthorized access attempts to protected endpoints; (5) Subscribe to vendor advisory for patch availability notification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Metform Pro
View allRemote attackers can manipulate payment amounts in Stripe and PayPal transactions through the MetForm Pro WordPress plug
Broken Access Control in MetForm Pro WordPress plugin (versions <= 3.9.1) permits subscriber-level authenticated users t
GitHub PoC
Exploit-DB