CVE-2022-1442: Wpmet Metform Elementor Contact Form Builder

High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days.

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.

Affected products

• Wpmet Metform Elementor Contact Form Builder: before 2.1.4 (fixed in 2.1.4)

Published 2022-05-10. Last modified 2026-06-17.