CVE-2026-86813

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 - Unauthenticated Email Header Injection

2026-09-09 00:00
Artus KG

Strategic Overview

Status
Patched in 4.1.9
Affected Plugin
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
Affected Version
< 4.1.9
CVSS
5.3Medium
Weakness type
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE
CVE-2026-86813
View all MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor vulnerabilities

At a glance

CVE-2026-86813 is a medium-severity Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the MetForm WordPress plugin, affecting versions < 4.1.9. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 4.1.9; sites on affected versions should update now. Disclosed September 2026, reported by Artus KG.

Vulnerability Overview

The MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor plugin for WordPress is vulnerable to email header injection in all versions up to 4.1.9 (exclusive). This makes it possible for unauthenticated attackers to inject additional email headers that can used to perform actions like sending emails to unintended recipients.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Remediation

Update to version 4.1.9, or a newer patched version

How does WordSec protect against this?

Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: MetForm 4.1.9 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-86813https://www.wordfence.com/threat-intel/vulnerabilities/id/4dece711-f603-4133-aa15-5bb2bec381b6https://nvd.nist.gov/vuln/detail/CVE-2026-86813

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C