CVE-2026-0633

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0633", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-06T01:17:56.319Z", "datePublished": "2026-01-24T08:26:35.777Z", "dateUpdated": "2026-04-08T17:26:32.469Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:32.469Z"}, "affected": [{"vendor": "roxnor", "product": "MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes)."}], "title": "MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d72cc420-1ff5-403b-b4ea-7c820fdebcf3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3438419/metform"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "baseSeverity": "LOW"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2026-01-06T01:36:21.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-23T19:35:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T17:47:49.095336Z", "id": "CVE-2026-0633", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:47:55.740Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0633", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T17:47:49.095336Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:47:52.431Z"}}], "cna": {"title": "MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "roxnor", "product": "MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T01:36:21.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-23T19:35:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d72cc420-1ff5-403b-b4ea-7c820fdebcf3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3438419/metform"}], "descriptions": [{"lang": "en", "value": "The MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:32.469Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0633", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:32.469Z", "dateReserved": "2026-01-06T01:17:56.319Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-24T08:26:35.777Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor", "vendor": "roxnor", "versions": [{"lessThanOrEqual": "4.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes)."}, {"lang": "es", "value": "El plugin MetForm \u2013 Contact Form, Survey, Quiz, &amp; Custom Form Builder para Elementor para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en versiones hasta la 4.1.0, inclusive. Esto se debe al uso de un valor de cookie falsificable derivado \u00fanicamente del ID de entrada y del ID de usuario actual sin un secreto del lado del servidor. Esto hace posible que atacantes no autenticados accedan a los datos de entrada de env\u00edo de formularios a trav\u00e9s de los shortcodes de MetForm para entradas creadas dentro del TTL transitorio (el valor predeterminado es 15 minutos)."}], "id": "CVE-2026-0633", "lastModified": "2026-06-17T10:11:07.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0633", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T17:47:49.095336Z", "version": "2.0.3"}}]}, "published": "2026-01-24T09:15:52.843", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3438419/metform"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d72cc420-1ff5-403b-b4ea-7c820fdebcf3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:03:29.454775+00:00", "value": {"mitigation_remediation": ["Update the MetForm plugin to the latest version that removes the forgeable cookie mechanism.", "If an immediate update is unavailable, block or remove any MetForm shortcodes that expose individual entry data until the plugin is patched, or restrict such shortcodes to authenticated users only.", "Clear all existing form entry transients from the database or using WP\u2011CLI commands to eliminate cached data that could still be exposed."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "All releases of the MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin distributed by roxnor, specifically versions up to and including 4.1.0. The vulnerability is confined to the MetForm plugin itself; other WordPress core components or plugins are not directly affected by this forged cookie mechanism.", "description_and_impact": "The MetForm plugin for Elementor is vulnerable because an attacker can forge a cookie value that consists only of the form entry ID and the current user ID, without any server\u2011side secret. By creating a forged cookie for a short\u2011lived entry (cached for 15 minutes by default), an unauthenticated user can embed the MetForm shortcode that points to that entry ID and retrieve the entire submission data. The consequence is the exposure of any personal, financial, or otherwise sensitive information that users entered into survey or quiz forms. This flaw is an instance of Improper Authentication, classified as CWE\u2011287.", "risk_and_exploitability": "With a CVSS score of 3.7, the vulnerability carries moderate severity, and an EPSS score of less than 1% indicates a low probability of current exploitation. It is not listed in the CISA KEV catalog. The attack requires no user authentication; the attacker only needs knowledge or a guess of a valid entry ID and user ID that exist within the transient cache. Because the data is cached only for 15 minutes, the window of opportunity is limited, but during that period an attacker can read the exposed submission data, potentially revealing sensitive information. Due to the narrow exposure window combined with the moderate severity, immediate remediation is advised to prevent data leakage."}}}}, "created": "2026-01-26T11:48:19.674668+00:00", "updated": "2026-04-15T19:15:12.065627+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "roxnor", "roxnor$PRODUCT$metform_contact_form_survey_quiz_custom_form_builder_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}