CVE-2022-1442

🗓️ 10 May 2022 19:30:12Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 2242 Views🌐 WEB

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2022-1442	11 May 202200:33	–	circl
CNNVD	WordPress plugin Metform 安全漏洞	10 May 202200:00	–	cnnvd
CNVD	WordPress plugin Metform information leakage vulnerability	11 May 202200:00	–	cnvd
Cvelist	CVE-2022-1442 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure	10 May 202219:30	–	cvelist
GithubExploit	Exploit for Missing Authorization in Wpmet Metform_Elementor_Contact_Form_Builder	3 Aug 202310:47	–	githubexploit
Nuclei	WordPress Metform <=2.1.3 - Information Disclosure	5 Jun 202603:02	–	nuclei
NVD	CVE-2022-1442	10 May 202220:15	–	nvd
OpenVAS	WordPress Metform Elementor Contact Form Builder Plugin < 2.1.4 Information Disclosure Vulnerability	2 Mar 202300:00	–	openvas
Patchstack	WordPress Metform Elementor Contact Form Builder plugin <= 2.1.3 - Unauthenticated API keys and Secrets Disclosure vulnerability	23 Apr 202200:00	–	patchstack
Patchstack	WordPress RSVPMaker plugin <= 9.2.5 - Unauthenticated SQL Injection (SQLi) vulnerability	26 Apr 202200:00	–	patchstack

NVD

Vulners

Node

wpmet metform_elementor_contact_form_builderRange<2.1.4wordpress

[
  {
    "vendor": "roxnor",
    "product": "MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.1.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/04a46249-b5b2-4082-b520-cdc4a1370bb1
plugins	www.plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.php
gist	www.gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bf

Parameter	Position	Path	Description	CWE
mf_mailchimp_api_key	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_recaptcha_secret_key	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_recaptcha_secret_key_v3	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_mailchimp_list_id	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_slack_webhook	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_recaptcha_version	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_recaptcha_site_key	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_recaptcha_site_key_v3	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
mf_recaptcha_secret_key_v3	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862
input_names	path	core/forms/action.php	Unauthenticated access to core/forms/action.php allows disclosure of API keys and secrets used by third-party integrations.	CWE-862

08 Apr 2026 17:16Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 3.17.5

EPSS0.71377

SSVC

CWE-862