{"id":"CVE-2026-120847","kind":"vulnerability","aliases":["CVE-2026-120847"],"related":[],"title":"Metform WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.3.","summary":"Metform, a WordPress form builder plugin by Wpmet, has a missing authorization check that lets requests bypass its intended access controls. Affected versions are listed as all releases through 4.3.3, per the NVD description.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["metform","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Metform plugin version in the WordPress admin under Plugins, or with `wp plugin get metform --field=version` if WP-CLI is available.\n- Compare the installed version against 4.3.3; anything at or below that is in the affected range.","fix":"- Metform: a fixed version is not stated in the sources; unknown","status":"open","published_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:54+00:00","updated_at":"2026-11-07T10:48:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T10:48:54Z","model":"claude-haiku-5-5","output":{"fix":"- Metform: a fixed version is not stated in the sources; unknown","reach":"internet","title":"Metform WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"Metform, a WordPress form builder plugin by Wpmet, has a missing authorization check that lets requests bypass its intended access controls. Affected versions are listed as all releases through 4.3.3, per the NVD description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","metform","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted plugin functions and data","analyst_note":"Check the Wpmet Metform changelog or the Wordfence/WPScan entry for the fixed version and the exact affected endpoint and required role.","how_to_check":"- Check the installed Metform plugin version in the WordPress admin under Plugins, or with `wp plugin get metform --field=version` if WP-CLI is available.\n- Compare the installed version against 4.3.3; anything at or below that is in the affected range.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Metform WordPress plugin at version 4.3.3 or earlier are in the affected range. The sources do not say which forms, roles or settings are needed to reach the missing check, so treat any site with the plugin installed as in scope until the vendor's advisory is read.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4202,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120847':12A,15A '-2026':11A,14A '4.3.3':51B,77C 'access':8A,41B,67C 'affect':43B,72C 'allow':63C 'author':5A,33B,57C 'builder':26B 'bypass':38B 'check':6A,34B 'configur':66C 'control':9A,42B,68C 'cve':10A,13A 'descript':55B 'exploit':64C 'expos':7A 'form':25B 'host':20B 'incorrect':65C 'intend':40B 'issu':71C 'let':36B 'levels.this':70C 'list':46B 'metform':1A,16B,22B,61C,62C,73C 'miss':4A,32B,56C 'n/a':75C 'nvd':54B 'packag':17B 'per':52B 'plugin':3A,27B 'releas':49B 'request':37B 'secur':69C 'self':19B 'self-host':18B 'version':44B 'vulner':58C 'wordpress':2A,21B,24B 'wpmet':29B,60C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Metform WordPress plugin at version 4.3.3 or earlier are in the affected range. The sources do not say which forms, roles or settings are needed to reach the missing check, so treat any site with the plugin installed as in scope until the vendor's advisory is read.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","metform","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-120847':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':10A,13A 'expos':7A 'metform':1A 'miss':4A 'plugin':3A 'wordpress':2A","search_b":"'4.3.3':51B 'access':41B 'affect':43B 'author':33B 'builder':26B 'bypass':38B 'check':34B 'control':42B 'descript':55B 'form':25B 'host':20B 'intend':40B 'let':36B 'list':46B 'metform':16B,22B 'miss':32B 'nvd':54B 'packag':17B 'per':52B 'plugin':27B 'releas':49B 'request':37B 'self':19B 'self-host':18B 'version':44B 'wordpress':21B,24B 'wpmet':29B","search_c":"'4.3.3':77C 'access':67C 'affect':72C 'allow':63C 'author':57C 'configur':66C 'control':68C 'exploit':64C 'incorrect':65C 'issu':71C 'levels.this':70C 'metform':61C,62C,73C 'miss':56C 'n/a':75C 'secur':69C 'vulner':58C 'wpmet':60C","first_public_at":"2026-11-07T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120847","severity":null,"published_at":"2026-11-07T10:17:10+00:00","modified_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}