MetForm WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the MetForm WordPress plugin, specifically in versions through 4.1.0. The issue arises from the use of a forgeable cookie value that relies solely on the entry ID and current user ID, without a server-side secret. This vulnerability enables unauthenticated attackers to access form submission data via MetForm shortcodes, for entries created within the default transient time-to-live of 15 minutes.

Impact

Exploitation of this vulnerability allows unauthenticated users to access sensitive form submission data from entries created within the last 15 minutes.

Remediation

Users can update to MetForm version 4.1.1 or a newer patched version to address this vulnerability.