Vulnerabilities / MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor / WPSEC-2026-0016
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Unauthenticated reCAPTCHA v3 Bypass
Medium 5.3
CWE-693Fixed in 4.3.1
- ID
- WPSEC-2026-0016
- Plugin
- MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor (metform)
- Affected
- from 1.2.0 before 4.3.1
- Remediation
- Update to 4.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The MetForm plugin for WordPress is vulnerable to reCAPTCHA Bypass via the form submission endpoint (metform/v1/entries/insert) in versions 1.2.0 to 4.3.0 due to the server-side reCAPTCHA verification only running when the reCAPTCHA v2 site key is set, so the v3 token is never verified when only the v3 keys are configured. This makes it possible for unauthenticated attackers to submit reCAPTCHA-protected forms with an arbitrary 'g-recaptcha-response-v3' value, allowing automated spam and abusive submissions. The site must use reCAPTCHA v3 in MetForm's settings with the v2 site key left empty.
References
- https://wpsec.com/vuln/WPSEC-2026-0016/
- https://plugins.svn.wordpress.org/metform/tags/4.3.1/
- https://wordpress.org/plugins/metform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS