Description

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-03T06:16:43.763Z",
  "pubdate": "2026-10-03T06:16:43.763Z",
  "executiveSummary": "The MetForm WordPress plugin, specifically versions prior to 4.3.1, contains an improper access control vulnerability within its REST API implementation.\nThis security flaw allows unauthenticated, remote attackers to retrieve sensitive form submission data, including potentially private user information, by interacting directly with the exposed API endpoints.\nThe vulnerability stems from the plugin's failure to enforce appropriate authentication or authorization checks before processing requests for form submission records.\nThe impact is significant as it facilitates unauthorized data exfiltration without requiring any prior user privileges or system access.\nThe risk implication is a compromise of data confidentiality, potentially leading to the exposure of Personally Identifiable Information (PII) collected via MetForm-powered forms.\nAttackers do not require specific preconditions other than network reachability to the target WordPress instance, making this an easily exploitable issue with high impact on user privacy and organizational compliance.",
  "technicalDetails": "The vulnerability resides within the REST API controller logic of the MetForm plugin, which fails to adequately validate the identity of the requester before serving form submission data. In WordPress development, the register_rest_route function is used to define API endpoints; security relies on the 'permission_callback' argument to verify if the current user possesses the necessary capabilities to access the requested resource.\nIn affected versions of MetForm, the endpoint responsible for fetching submission entries either lacks this callback entirely or uses an improperly configured one that defaults to permitting access to unauthenticated requests. This effectively bypasses the standard WordPress security model, which should restrict such administrative data access to authorized users with sufficient capabilities, such as 'manage_options' or 'edit_posts'.\nThe exploitation process follows a predictable pattern. An attacker identifies the specific REST API endpoint registered by the plugin, typically following the pattern /wp-json/metform/v1/..., and executes a GET request to the target resource. Because the backend fails to verify session cookies or nonces, the plugin's internal database query logic proceeds to retrieve the stored form entries from the database.\nThe payload response from the server includes the serialized form data, which may contain sensitive fields submitted by users, such as names, email addresses, phone numbers, or custom inputs defined in the form configuration. This process occurs entirely in the background, leaving minimal footprint in standard application logs.\nThe attack flow is as follows: 1) The attacker enumerates the REST API endpoints to identify the plugin's vulnerable route. 2) The attacker sends a crafted HTTP GET request to the identified endpoint. 3) The plugin's controller function is triggered, performing a database lookup for submission records without authenticating the user. 4) The plugin returns the full JSON-formatted dataset of form submissions to the unauthorized caller. 5) The attacker captures the PII for malicious use or data harvesting.\nThe post-exploitation impact includes unauthorized mass extraction of user data, which could lead to identity theft, phishing campaigns targeting the exposed users, or the leakage of proprietary or internal business information gathered through web forms. Given the nature of WordPress installations, this vulnerability is globally exploitable over the public internet, posing a severe risk to any site using the vulnerable versions of MetForm."
}