CVE-2026-114180: WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/metformto a version that resolves this vulnerability.Fixed in 4.3.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector is network-based and requires no privileges or user interaction, so an unauthenticated remote attacker may be able to exploit an affected installation.
Which Metform versions are affected?
The issue affects Wpmet Metform through version 4.3.2. The available data does not identify a fixed version.
What is the likely security impact?
The reported CVSS vector indicates an integrity impact only, with no reported confidentiality or availability impact. The issue is categorized as broken access control caused by missing authorization.