CVE-2022-1442

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.

• CWE-862
• CWE-862
• CWE-862

• https://gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bfExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.phpPatch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/04a46249-b5b2-4082-b520-cdc4a1370bb1?source=cveThird Party Advisory
• https://gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bfExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.phpPatch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/04a46249-b5b2-4082-b520-cdc4a1370bb1?source=cveThird Party Advisory

Published

May 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1436The WPCargo Track & Trace WordPress plugin before 6.9.5 does…6.1
• CVE-2022-1437Heap-based Buffer Overflow in GitHub repository radareorg/ra…7.1
• CVE-2022-1438A flaw was found in Keycloak. Under specific circumstances, …4.8
• CVE-2022-1439Reflected XSS on demo.microweber.org/demo/module/ in GitHub …6.1
• CVE-2022-1440Command Injection vulnerability in git-interface@2.1.1 in Gi…9.8
• CVE-2022-1441MP4Box is a component of GPAC-2.0.0, which is a widely-used …7.8
• CVE-2022-1443Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2022-1444heap-use-after-free in GitHub repository radareorg/radare2 p…5.5
• CVE-2022-1445Stored Cross Site Scripting vulnerability in the checked_out…5.4
• CVE-2022-1451Out-of-bounds Read in r_bin_java_constant_value_attr_new fun…7.1
• CVE-2022-1452Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new …7.1
• CVE-2022-1453The RSVPMaker plugin for WordPress is vulnerable to unauthen…7.5