CVE-2024-4266 is a Medium (CVSS 5.3) sensitive information exposure in the MetForm form builder plugin for WordPress, in versions up to and including 3.8.8. The record says unauthenticated visitors can pull data such as personal information from files users uploaded. Update the plugin past 3.8.8.
What's affected
- Product: MetForm, the contact form, survey, quiz and custom form builder for Elementor, from wpmet.
- Affected versions: all up to and including 3.8.8, via the handle_file function.
- Fixed version: the record does not name one. It links a Trac changeset, which I did not fetch. Use the newest release in the plugin directory and read its changelog.
- Severity: Medium, CVSS 5.3, with low confidentiality impact and no privileges or interaction.
- Exploitation: KEV is false. Nothing I read says it is exploited.
How to check if you're exposed
List your plugins and versions from the server:
wp plugin list --fields=name,version,status,update
Look for the metform line. A version of 3.8.8 or lower matches the record. Also look at where the plugin stores uploaded files and whether those files include identity documents, resumes or medical forms, because that is what a visitor could reach.
What to do now
- Run the command above on each WordPress site and note the MetForm version.
- Update MetForm to the current release from the WordPress admin or with wp plugin update.
- Review which forms accept file uploads and what kinds of files visitors send.
- Delete uploaded files you no longer need, and keep a retention rule for the rest.
- Check access logs for unusual requests to the form upload paths.
Why it matters
The record maps this to CWE-200, exposure of sensitive information to an unauthorized actor. The handle_file function deals with files attached to submissions, and the flaw lets someone without an account get at them.
The CVSS score is modest because it does not change or delete anything. The business risk depends on the content. A contact form that collects passport scans is a different problem from one that collects a short note.
Quick check
Is MetForm 3.8.9 confirmed fixed?
The record does not state a fixed version, and I did not fetch the changeset. Use the latest release and read its changelog.
Why a medium score if personal data leaks?
The vector rates the confidentiality impact as low. Judge the real impact by what your forms collect.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4266 (published 2024-06-11) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
