CVE-2026-0633: MetForm WordPress Plugin Info Disclosure

CVE-2026-0633 Overview

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This vulnerability arises from the use of a forgeable cookie value derived only from the entry ID and current user ID without incorporating a server-side secret. This weakness allows unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes).

Critical Impact

Unauthenticated attackers can access sensitive form submission data including user-submitted information from contact forms, surveys, and quizzes within a 15-minute window after submission.

Affected Products

• MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin versions up to and including 4.1.0
• WordPress installations with vulnerable MetForm plugin versions
• Sites using MetForm shortcodes for form entry display

Discovery Timeline

• 2026-01-24 - CVE CVE-2026-0633 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-0633

Vulnerability Analysis

This vulnerability is classified as CWE-287 (Improper Authentication), specifically relating to the weak authentication mechanism used for cookie validation in the MetForm plugin. The core issue lies in the plugin's implementation of cookie-based authentication for accessing form submission entries.

The plugin generates cookie values using only the entry ID and current user ID as inputs, without incorporating a cryptographically secure server-side secret. This predictable cookie generation scheme allows attackers to forge valid authentication cookies by simply knowing or guessing entry IDs.

The attack is constrained by the transient TTL (Time-To-Live), which defaults to 15 minutes. During this window, an attacker can craft forged cookies to access recently submitted form entries without requiring any authentication credentials.

Root Cause

The root cause of this vulnerability is the absence of a server-side secret in the cookie generation algorithm. By relying solely on predictable values (entry ID and user ID), the plugin creates a weak authentication scheme that can be exploited through cookie forgery. Proper cryptographic practices require incorporating unpredictable, server-side secrets when generating authentication tokens to prevent forgery attacks.

Attack Vector

The attack is conducted over the network and does not require any authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a WordPress site using the vulnerable MetForm plugin
2. Monitoring or predicting entry IDs (which are typically sequential)
3. Generating forged cookie values using the predictable algorithm
4. Accessing form submission data through MetForm shortcodes before the transient TTL expires

The vulnerability allows access to any data submitted through MetForm forms, which may include personally identifiable information, contact details, survey responses, and quiz answers.

Detection Methods for CVE-2026-0633

Indicators of Compromise

• Unusual access patterns to MetForm shortcode endpoints from unauthenticated sessions
• Multiple requests with varying cookie values attempting to access form entries
• Suspicious cookie manipulation in HTTP request headers targeting MetForm functionality
• Access attempts to sequential entry IDs within short time windows

Detection Strategies

• Monitor web server logs for repeated requests to pages containing MetForm shortcodes with unusual cookie patterns
• Implement web application firewall (WAF) rules to detect cookie manipulation attempts
• Review access logs for unauthenticated users accessing form entry data
• Deploy intrusion detection signatures for MetForm-specific exploitation patterns

Monitoring Recommendations

• Enable detailed logging on WordPress installations to capture authentication-related events
• Set up alerts for anomalous access to form submission data endpoints
• Monitor for bulk or sequential access attempts to form entries
• Implement rate limiting on pages displaying form submission data

How to Mitigate CVE-2026-0633

Immediate Actions Required

• Update the MetForm plugin to the latest patched version immediately
• Audit recent form submissions for potential unauthorized access
• Review server logs for suspicious activity targeting MetForm functionality
• Consider temporarily disabling MetForm shortcodes that display entry data until patched

Patch Information

The vendor has released a security patch addressing this vulnerability. The patch changeset is available at the WordPress Plugin Change Log. Additional vulnerability details can be found in the Wordfence Vulnerability Report.

WordPress administrators should update the MetForm plugin through the WordPress admin dashboard or by manually downloading the patched version from the WordPress plugin repository.

Workarounds

• Restrict access to pages containing MetForm shortcodes using WordPress authentication requirements
• Implement additional access controls at the web server or WAF level to protect form entry endpoints
• Reduce the transient TTL if possible through plugin configuration or custom code modifications
• Consider using alternative form plugins until the patch can be applied

# Check current MetForm plugin version
wp plugin list --name=metform --fields=name,version

# Update MetForm plugin to latest version
wp plugin update metform

# Verify the update was successful
wp plugin list --name=metform --fields=name,version,update_version