What is the CVSS score of EUVD-2026-37665?

EUVD-2026-37665 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of MetForm Pro are affected by EUVD-2026-37665?

WPMET MetForm Pro (versions 3.9.1 and earlier) contains a critical unauthenticated access control vulnerability allowing attackers to bypass authorization and access protected form functionality…

How to fix or mitigate EUVD-2026-37665?

Within 24 hours: Identify all WordPress installations running MetForm Pro and document affected version numbers; temporarily disable the plugin on non-critical systems. Within 7 days: Monitor WPMET security advisory channels for patch release; apply immediately upon availability to all affected instances. Within 30 days: Verify patched version deployed organization-wide; implement permanent Web Application Firewall rules blocking unauthorized MetForm Pro endpoint access as layered defense.

MetForm Pro EUVD-2026-37665

| CVE-2026-24611 CRITICAL

Missing Authorization (CWE-862)

2026-06-17 Patchstack

WordPress Authentication Bypass Metform Pro Wordpress Plugin Wpmet

9.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Plugin endpoint is network-reachable with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); broken access control on form data yields C:H and A:H, with I:N retained per vendor scoring.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:28 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.

AnalysisAI

Unauthenticated broken access control in WPMET MetForm Pro WordPress plugin versions 3.9.1 and earlier allows remote attackers to access protected functionality without credentials, with CVSS 9.1 reflecting high confidentiality and availability impact. Reported by Patchstack, the flaw stems from missing authorization (CWE-862) on plugin endpoints, and no public exploit identified at time of analysis.

Technical ContextAI

MetForm Pro is a premium WordPress form-builder plugin by Wpmet, typically used with Elementor to build contact, registration, and payment forms; the affected CPE is cpe:2.3:a:wpmet:metform_pro covering all versions up to and including 3.9.1. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin actions (likely AJAX handlers or REST routes registered by the plugin) execute privileged logic without verifying the caller's capability or nonce. In WordPress plugins this class of flaw typically appears when register_rest_route() omits a permission_callback or when admin-ajax actions skip current_user_can() and check_ajax_referer() checks, exposing form submission data, form configuration, or backend integrations to anonymous callers.

RemediationAI

Patch status from the available data is ambiguous - the Patchstack record covers '<= 3.9.1', which typically implies a fixed version above 3.9.1, but no exact fix version is provided in this input, so treat this as 'Patch available per vendor advisory' and confirm the exact fixed release at https://patchstack.com/database/wordpress/plugin/metform-pro/vulnerability/wordpress-metform-pro-plugin-3-9-1-broken-access-control-vulnerability-2 before deploying. Upgrade MetForm Pro to the latest version published by Wpmet that is strictly greater than 3.9.1; until then, consider deactivating MetForm Pro on sites that do not actively need it (side effect: any pages relying on its forms will break), or place the site behind a WAF rule that blocks unauthenticated requests to MetForm Pro's REST routes and admin-ajax actions (side effect: legitimate front-end form submissions from anonymous users may also be blocked and need allow-listing).