CVE-2022-1442 in Metform Plugin
Summary
by MITRE • 05/11/2022
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/08/2026
The CVE-2022-1442 vulnerability affects the Metform WordPress plugin, a popular form builder tool that integrates with numerous third-party services. This security flaw represents a critical access control failure that allows unauthenticated attackers to extract sensitive configuration data from the plugin's core components. The vulnerability exists within the ~/core/forms/action.php file, which serves as a central processing point for form submissions and API integrations. The improper access control implementation creates a direct pathway for attackers to bypass authentication mechanisms and gain unauthorized access to critical system information.
The technical nature of this vulnerability stems from inadequate input validation and access restriction controls within the plugin's architecture. When the action.php file processes requests, it fails to properly verify user authentication status or implement proper authorization checks before exposing API key and secret information. This allows any remote attacker to craft malicious requests that directly access the sensitive data storage mechanisms without requiring valid credentials or administrative privileges. The vulnerability affects all versions of the Metform plugin up to and including version 2.1.3, indicating a long-standing issue that has persisted across multiple releases. The exposed data includes authentication tokens for payment processors such as PayPal and Stripe, email marketing platforms like Mailchimp, CRM systems including Hubspot, customer support tools like HelpScout, and security services such as reCAPTCHA.
The operational impact of this vulnerability is severe and far-reaching for affected organizations. Once exploited, attackers can gain complete control over integrated third-party services, potentially leading to unauthorized transactions, data breaches, account takeovers, and service abuse. The exposure of API keys and secrets enables attackers to impersonate legitimate users within these integrated systems, creating a cascading effect of potential damage across multiple platforms. Organizations using the Metform plugin may experience unauthorized financial transactions through compromised payment processing integrations, unauthorized email campaigns through breached email marketing services, and potential data exfiltration from connected CRM and helpdesk systems. The vulnerability also poses risks to user privacy and data protection compliance, as attackers could access sensitive customer information stored within these integrated services.
From a cybersecurity perspective, this vulnerability maps directly to CWE-284 (Improper Access Control) and aligns with several MITRE ATT&CK framework techniques including T1078 (Valid Accounts) and T1566 (Phishing). The lack of proper access controls in the plugin's core functionality creates an ideal attack vector for credential theft and privilege escalation. Security practitioners should note that this vulnerability demonstrates the critical importance of proper input validation and access control implementation in web applications. The attack surface extends beyond the immediate plugin to encompass all third-party services that rely on the exposed API keys, making this a particularly dangerous vulnerability from a risk management perspective. Organizations should immediately implement mitigation strategies including plugin updates, network segmentation, and monitoring for suspicious API access patterns to prevent exploitation of this vulnerability.
The remediation approach requires immediate plugin version updates to the latest secure release, which should include proper access control mechanisms and input validation. Additionally, organizations should conduct comprehensive security audits of their integrated services to revoke and regenerate exposed API keys and secrets. Network monitoring should be enhanced to detect unusual API access patterns, and access logs should be reviewed for potential exploitation indicators. The vulnerability highlights the critical need for regular security assessments of third-party plugins and the importance of maintaining up-to-date software versions to prevent exploitation of known security flaws.