The Metform plugin contains a broken access control flaw that permits a user to perform actions reserved for higher‑privileged roles. The weakness, identified as CWE‑862, enables the attacker to access or manipulate sensitive form data, edit form settings, or execute administrative actions without proper authorization. This could lead to data exposure, unauthorized configuration changes, and potentially further exploitation of the site.

All WordPress installations using the Metform plugin version 4.3.2 or earlier are impacted. This includes every release from the initial rollout up to and including 4.3.2.

The CVSS score of 5.3 classifies the vulnerability as moderate, and it is not listed in the CISA KEV catalog. The EPSS score is not available, so the probability of exploitation is currently unknown. Based on the description, the likely attack vector is through exposed administrative endpoints that lack sufficient authorization checks; therefore an attacker who can reach those endpoints or compromise a low‑privileged account may be able to elevate their privileges. No prerequisites beyond normal WordPress access appear to be required, making the risk realistic for sites with this plugin.