Sensitive Information Exposure in MetForm Plugin for WordPress
CVE-2026-0633

3.7LOW

Key Information:

Vendor

WordPress
Status
Metform – Contact Form, Survey, Quiz, & Custom Form Builder For Elementor
Vendor
CVE Published:
24 January 2026

What is CVE-2026-0633?

The MetForm plugin for WordPress is susceptible to a sensitive information exposure that can be exploited by unauthenticated attackers. The vulnerability arises from a forgeable cookie designed using only the entry ID and the current user ID, without any server-side secret for protection. This flaw allows attackers to access confidential form submission data, specifically from entries created within a 15-minute transient TTL, through the MetForm shortcodes.

Affected Version(s)

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor 0 <= 4.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3438419/metform

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

M Indra Purnama
.