CVE-2026-86832
MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API
MEDIUM 5.3EPSS 0.2%
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
- Affected
- MetForm
- CVSS v3.1 CNA
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.21% chance of exploitation in the next 30 days, 10th percentile
- Published
- 2026-10-03