CVE-2026-86834

LowCVSS 3.7/10Last modified Oct 6, 2026

Description

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-868368.4In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta CVE-2026-868375.3The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauth CVE-2026-868385.3The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appoint CVE-2026-868393.8The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requ CVE-2026-86845.3The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is CVE-2026-868409.1The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A sign CVE-2026-868414.7The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and d CVE-2026-868426.8The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management acti CVE-2026-868436.3The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templ CVE-2026-868456.5A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check CVE-2026-868466.5A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, cau CVE-2026-868476.5A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest desc