CVE-2026-86834

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: WPScan

Description

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86834

EUVD

EUVD-2026-91940

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	MetForm	2.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The MetForm WordPress plugin before version 4.3.1 has a vulnerability where it writes a debug file to the web root during form submissions when the HubSpot Forms integration is enabled. This file is not properly restricted, allowing unauthenticated attackers to access it and read sensitive data such as API response details, correlation identifiers, and cookies.

Detection Guidance

Check for the presence of a debug file in the web root of your WordPress installation, typically named something like debug.log or similar. This file may be generated by the MetForm plugin when HubSpot Forms integration is enabled. Verify if the file is accessible without authentication by attempting to access it directly via a web browser or using curl commands to fetch its contents.

Impact Analysis

This vulnerability allows attackers to access sensitive data like cookies and API responses, which could include session tokens or personal information. This may lead to unauthorized access to user accounts, data breaches, or further exploitation of the affected system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using the affected plugin may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update the MetForm plugin to version 4.3.1 or later to patch the vulnerability. If updating is not immediately possible, disable the HubSpot Forms integration in the MetForm plugin settings to prevent the debug file from being generated. Additionally, restrict access to the web root directory to prevent unauthorized access to sensitive files.

Hi! I’m here to help you understand CVE-2026-86834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70