CVE-2022-1442

HIGH NUCLEI

MetForm < 2.1.3 - Unauthenticated Sensitive Information Disclosure in action.php

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-1442. PoCs published by RandomRobbieBF. A Nuclei detection template is also available.

AI-analyzed exploit summary This PoC exploits an improper access control vulnerability in WordPress Plugin Metform <= 2.1.3, allowing unauthenticated attackers to disclose sensitive API keys and secrets via REST API endpoints. The script automates the extraction of form data containing third-party API credentials.

Description

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.

Exploits (1)

nomisec WORKING POC

by RandomRobbieBF · poc

https://github.com/RandomRobbieBF/CVE-2022-1442

View Code ZIP pw:eip

This PoC exploits an improper access control vulnerability in WordPress Plugin Metform <= 2.1.3, allowing unauthenticated attackers to disclose sensitive API keys and secrets via REST API endpoints. The script automates the extraction of form data containing third-party API credentials.

Classification

Working Poc 95%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: WordPress Plugin Metform <= 2.1.3

No auth needed

Prerequisites: Target must have Metform plugin <= 2.1.3 installed · REST API endpoints must be accessible

MITRE ATT&CK

T1592 - Gather Victim Host Information T1119 - Automated Collection

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

WordPress Metform <=2.1.3 - Information Disclosure

HIGHVERIFIEDby theamanrawat

References (3)

Core 3

Core References

Exploit, Third Party Advisory

https://gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bf

Patch, Third Party Advisory

https://plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.php

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/04a46249-b5b2-4082-b520-cdc4a1370bb1?source=cve

Scores

CVSS v3 7.5

EPSS 0.7138

EPSS Percentile 98.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

roxnor/MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor < 2.1.3

wpmet/metform_elementor_contact_form_builder < 2.1.4

Published May 10, 2022

Tracked Since Feb 18, 2026