EUVD-2026-91940
GHSA-cr6m-q4jq-r64m
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it needs the non-default HubSpot integration enabled plus locating the written file; only limited confidentiality impact (C:L), no integrity or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.
AnalysisAI
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies - from WordPress sites running the MetForm plugin before 4.3.1, because the plugin writes a debug file into the web root on every form submission whenever its HubSpot Forms integration is enabled and does not restrict access to that file. Exploitation requires the non-default HubSpot integration to be active, at least one prior form submission to populate the file, and discovery of the file's location, which is why the assessed vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact and a low base score of 3.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the site to have MetForm's HubSpot Forms integration specifically enabled - this is the triggering condition, since the debug file is only written under that integration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals converge on genuinely low real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading MetForm to 4.3.1 or later; this is the definitive fix and removes the insecure debug-file behavior for sites using the HubSpot Forms integration. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-fie
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data
Stored cross-site scripting in the Wpmet Metform WordPress plugin (versions through 4.3.0) lets a low-privilege authenti
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today