CVE-2026-86832

{
  "etk_id": "ETK-2026-598",
  "cve_id": "CVE-2026-86832",
  "display_id": "CVE-2026-86832",
  "ghsa_id": "GHSA-5m3g-q793-wg8x",
  "euvd_id": "EUVD-2026-91939",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated form submission data exposure in MetForm",
  "summary": "MetForm for WordPress versions before 4.3.1 insufficiently restrict access to form submission data through its REST API. An unauthenticated attacker may be able to view information submitted through forms without needing an account.",
  "mitigation": "Update the MetForm WordPress plugin to version 4.3.1 or later. Until updates are complete, restrict public access to the affected REST API endpoints where feasible.",
  "vendor": null,
  "product": "MetForm",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4.3.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.3.1"
      ],
      "package_name": "MetForm",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 5.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss_score": 0.0021,
  "epss_percentile": 0.1005,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 21.383785133333333,
  "t0_at": "2026-10-03T06:00:26.051000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-04T22:58:03.930474+00:00",
      "days": 1.706688419837963,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:26.051000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-10-04T22:58:03.930474+00:00",
      "days": 1.706688419837963,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:26.051000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T06:00:26.051000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:00:26.051000+00:00",
      "url": "https://github.com/advisories/GHSA-5m3g-q793-wg8x"
    }
  }
}