The Metform WordPress plugin contains a missing authorization flaw that permits exploitation of incorrectly configured access control settings. Attackers could leverage exposed endpoints that are not properly protected, leading to unauthorized use of application features. This weakness is identified as CWE‑862 and does not provide direct remote code execution, but it enables misuse of privileged functions within the plugin.

The vulnerability is present in the Metform plugin developed by Wpmet. All releases from the earliest available version up through 4.3.3 are affected. Upgrading to version 4.3.4 or later addresses the issue.

The CVSS score of 4.3 classifies this issue as low to moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited public exploitation. Attackers would need to discover the improperly secured endpoints; the flaw does not grant arbitrary code execution or elevate privileges beyond the application layer. Nevertheless, the potential to gain unauthorized access to plugin functions warrants timely remediation.