CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 2.1.3 lack proper authorization checks, allowing unauthenticated attackers to read sensitive form data and submissions. An attacker can access form responses without logging in or having permission. This affects all sites running the vulnerable plugin versions. Update to a version newer than 2.1.3 to resolve the issue.
What an attacker can do
Read form submissions and sensitive data without authentication.
Potential impact on your site
Form submissions, user responses, and collected data are exposed to anyone on the internet.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
