Unauthenticated Information Exposure in MetForm WordPress Plugin

Executive Summary

The MetForm WordPress plugin before version 4.3.1 has a vulnerability where it does not properly restrict access to form submission data. This allows unauthenticated attackers to view submitter information through the REST API.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your MetForm plugin version is below 4.3.1. You can verify the installed version via WordPress admin panel under Plugins or by inspecting the plugin files. Additionally, monitor REST API requests to the /wp-json/metform/v1/entries endpoint for unauthorized access attempts.

Useful 0 Not Useful 0

Impact Analysis

Attackers can access sensitive submitter information without authentication. This includes data from contact forms, surveys, and quizzes, potentially exposing personal details of users who submitted forms.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal data. Organizations may face legal penalties, fines, and reputational damage for failing to protect sensitive user information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the MetForm plugin to version 4.3.1 or later through the WordPress admin panel. If updating is not possible, consider temporarily disabling the plugin until an update is applied. Review server logs for suspicious API access to the affected endpoint.

Useful 0 Not Useful 0