CVE-2026-86832

MediumCVSS 5.3/10Last modified Oct 6, 2026

Description

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-868335.4The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body o CVE-2026-868343.7The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submiss CVE-2026-868368.4In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta CVE-2026-868375.3The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauth CVE-2026-868385.3The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appoint CVE-2026-868393.8The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requ CVE-2026-86845.3The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is CVE-2026-868409.1The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A sign CVE-2026-868414.7The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and d CVE-2026-868426.8The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management acti CVE-2026-868436.3The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templ CVE-2026-868456.5A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check