CVE-2024-4266: Wpmet Metform Elementor Contact Form Builder

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.

Affected products

• Wpmet Metform Elementor Contact Form Builder: before 3.8.9 (fixed in 3.8.9)

Published 2024-06-11. Last modified 2026-06-17.