Login Request a demo
Low severity · published Jan 24, 2026
CVE-2026-0633
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value
3.7
CVSS
0.2%
EPSS
No
On KEV
Description
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor · roxnor
through 4.1.0 · source: vendor
Affected product
MC
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
roxnor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0633
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3438419/metform
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/d72cc420-1ff5-403b-b4ea-7c820fdebcf3?source=cve
More from MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
9.8
CVE-2023-0714
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
7.5
CVE-2024-4266
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
6.4
CVE-2025-5684
MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element
5.4
CVE-2024-2791
Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets
5.4
CVE-2024-1585
Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode