Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

MetForm plugin may expose debug file with sensitive data

CVE-2026-86834 · published 16 days ago
Summary

The MetForm plugin for WordPress creates a debug file in the website’s public folder each time a form is submitted when the HubSpot integration is turned on. Because the file is not protected, anyone on the internet could view the file and see information such as internal identifiers and user cookies. Update the plugin to version 4.3.1 or later, or turn off the HubSpot Forms integration, to stop the file from being publicly readable.

Original advisory text
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowi...
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published3 Oct 2026
Updated15 Oct 2026
First seen3 Oct 2026
Sources
CVE-2026-86834 · NVD
Track software like this
Free during beta