Medium severity5.3NVD Advisory· Published Jun 11, 2024· Updated Apr 8, 2026

CVE-2024-4266

Description

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpmet/Metform Elementor Contact Form Builder
cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*
Range: <3.8.9
MetForm Pro/MetForm Prollm-fuzzy
Range: <=3.8.8
WordPress/MetForm Prowp-canonicalize

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3099977/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03nvdThird Party Advisory
plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000