What is GHSA-cr6m-q4jq-r64m?

GHSA-cr6m-q4jq-r64m is a security advisory published by GitHub Security Advisories with Low severity. The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it...

Which CVE IDs does GHSA-cr6m-q4jq-r64m cover?

GHSA-cr6m-q4jq-r64m covers the following CVE IDs: CVE-2026-86834. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cr6m-q4jq-r64m?

GHSA-cr6m-q4jq-r64m has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-cr6m-q4jq-r64mLowCVSS 3.7

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it...

Vendor

GitHub Security Advisories

Published

October 3, 2026

Last Modified

October 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-86834 →

📋 Description

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86834
https://wpscan.com/vulnerability/a56b7e26-9070-4c38-bdc1-7289b5829638
https://github.com/advisories/GHSA-cr6m-q4jq-r64m