Live › vulnerability › CVE-2026-114180
Go to dashboardMetform, a WordPress form builder plugin by Wpmet, has a missing authorization check in versions through 4.3.2. The sources do not say which actions an attacker can perform with it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that run the Metform WordPress plugin at version 4.3.2 or earlier are in scope. The sources do not say which configuration or role makes the flaw reachable, so whether a logged-out visitor can trigger it is unknown.
No product ranges from the sources yet.
wp plugin get metform --field=version4.3.2 as affected4.3.2 (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114180")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.