Analysis Report · Folder Analysis cache/metform_4.1.0 → cache/metform_4.1.1 — CVE-2026-0633

--- cache/metform_4.1.0/core/entries/action.php	2026-01-24 00:21:48.247679467 +0000+++ cache/metform_4.1.1/core/entries/action.php	2026-01-24 00:25:40.466115663 +0000@@ -740,7 +740,69 @@ 
             }
         }
+        
+        // google drive
+        if(class_exists('\MetForm_Pro\Core\Integrations\Google_Drive\MF_Google_Drive')) {            
+            if(isset($this->form_settings['mf_google_drive']) && $this->form_settings['mf_google_drive'] == 1) {
+                $google_drive_folder_list_id = isset($this->form_settings['mf_google_drive_folder_list_id']) ? 
+                    ["folder_id" => $this->form_settings['mf_google_drive_folder_list_id']] : null;
+                
+                // Filter file_upload_info to only include mf-file-upload widget data
+                $filtered_file_upload_info = isset($this->file_upload_info['mf-file-upload']) ? 
+                    ['mf-file-upload' => $this->file_upload_info['mf-file-upload']] : [];
+                
+                if (!empty($filtered_file_upload_info) && !empty($google_drive_folder_list_id)) {
+                    $drive = \MetForm_Pro\Core\Integrations\Google_Drive\MF_Google_Drive::instance()->insert_file(
+                        $this->form_id, 
+                        $this->title, 
+                        $this->form_data, 
+                        $filtered_file_upload_info, 
+                        $this->get_fields($this->form_id), 
+                        $google_drive_folder_list_id
+                    );
+                    
+                    if ($drive === false) {
+                        $this->response->error[] = esc_html__('Google Drive upload failed: SSL certificate or OAuth credentials problem', 'metform');
+                        $this->response->status = 0;
+                        return $this->response;
+                    }
+                }
+            }
+        }
 
+        // dropbox file upload
+        if (class_exists('\MetForm_Pro\Core\Integrations\Dropbox\MF_Dropbox')) {
+            if (isset($this->form_settings['mf_dropbox']) && $this->form_settings['mf_dropbox'] == '1') {
+                
+                $dropbox_folder_path = isset($this->form_settings['mf_dropbox_list_id']) ? $this->form_settings['mf_dropbox_list_id'] : '';
+                
+                // Only process files from mf-file-upload widget
+                if (!empty($dropbox_folder_path) && isset($this->file_upload_info['mf-file-upload']) && is_array($this->file_upload_info['mf-file-upload'])) {
+                    $dropbox = \MetForm_Pro\Core\Integrations\Dropbox\MF_Dropbox::instance();
+                    
+                    // Process each uploaded file from mf-file-upload widget
+                    foreach ($this->file_upload_info['mf-file-upload'] as $file) {
+                        if (!is_array($file)) {
+                            continue;
+                        }
+                        
+                        // Check for 'file' key (actual structure) or 'file_path' key (legacy)
+                        $file_path = isset($file['file']) ? $file['file'] : (isset($file['file_path']) ? $file['file_path'] : '');
+                        
+                        if (!empty($file_path) && file_exists($file_path)) {
+                            // Use 'name' key from file array, fallback to basename
+                            $file_name = isset($file['name']) ? $file['name'] : basename($file_path);
+                            $upload_result = $dropbox->upload_file(
+                                $file_path,
+                                $dropbox_folder_path,
+                                $file_name
+                            );
+                        }
+                    }
+                }
+            }
+        }
+        
         $form_settings = $this->form_settings;
         $form_id = $this->form_id;
 
@@ -803,10 +865,22 @@         //## set stransient token for data access checking 
         set_transient('transient_mf_form_data_entry_id_'.$this->entry_id, $this->entry_id, 15*60);
         
-        $mf_make_str_for_hashing = $this->entry_id.get_current_user_id();
-        $mf_hashed_str_for_access_check = password_hash($mf_make_str_for_hashing,PASSWORD_DEFAULT);
-        // setup cookie for current submission.
-        setcookie(base64_encode('mf-cookie'), $mf_hashed_str_for_access_check, time()+(60*15),'/');
+       // Generate a cryptographically secure random token
+        $mf_secure_token = wp_generate_password(32, false);
+        // Store the hashed token in a transient keyed by entry ID
+        $mf_token_hash = hash('sha256', $mf_secure_token);
+        set_transient('transient_mf_token_hash_'.$this->entry_id, $mf_token_hash, 15*60);
+        
+        // Set the raw token as an HttpOnly, Secure, SameSite cookie
+        $cookie_options = array(
+            'expires' => time() + (60 * 15),
+            'path' => '/',
+            'domain' => '',
+            'secure' => is_ssl(),
+            'httponly' => true,
+            'samesite' => 'Strict'
+        );
+        setcookie(base64_encode('mf-cookie'), $mf_secure_token, $cookie_options);
     }
 
     private function update()

Based on my analysis of the code diff, here are the security vulnerabilities:

---

**Vulnerability 1: Insecure Token Generation and Cookie Security**

Vulnerability Existed: yes
TRUE POSITIVE

Insecure Randomness & Weak Cryptographic Cookie Token - CWE-338 & CWE-614 - core/entries/action.php (lines 806-809)

**Old Code:**
```php
$mf_make_str_for_hashing = $this->entry_id.get_current_user_id();
$mf_hashed_str_for_access_check = password_hash($mf_make_str_for_hashing,PASSWORD_DEFAULT);
// setup cookie for current submission.
setcookie(base64_encode('mf-cookie'), $mf_hashed_str_for_access_check, time()+(60*15),'/');
```

**Fixed Code:**
```php
// Generate a cryptographically secure random token
$mf_secure_token = wp_generate_password(32, false);
// Store the hashed token in a transient keyed by entry ID
$mf_token_hash = hash('sha256', $mf_secure_token);
set_transient('transient_mf_token_hash_'.$this->entry_id, $mf_token_hash, 15*60);

// Set the raw token as an HttpOnly, Secure, SameSite cookie
$cookie_options = array(
    'expires' => time() + (60 * 15),
    'path' => '/',
    'domain' => '',
    'secure' => is_ssl(),
    'httponly' => true,
    'samesite' => 'Strict'
);
setcookie(base64_encode('mf-cookie'), $mf_secure_token, $cookie_options);
```

Explanation:
The old code had multiple critical security issues: (1) **CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator)** - it generated tokens deterministically from user ID and entry ID, making them predictable; (2) **CWE-614 (Sensitive Cookie without 'HttpOnly' Flag)** - the cookie lacked HttpOnly, Secure, and SameSite flags, exposing it to XSS attacks and CSRF; (3) the cookie stored the password hash directly, defeating the purpose of hashing. The fix uses cryptographically secure token generation, implements server-side token verification via transient hashing, and adds proper cookie security flags (HttpOnly to prevent XSS access, Secure for HTTPS-only transmission, and SameSite=Strict for CSRF protection).

---

**Vulnerability 2: Path Traversal via Unsanitized File Operations**

Vulnerability Existed: not sure

CWE-22 (Path Traversal) - core/entries/action.php (lines 790-801)

**Old Code:**
```
[No equivalent old code - this is new functionality]
```

**Fixed Code:**
```php
// Check for 'file' key (actual structure) or 'file_path' key (legacy)
$file_path = isset($file['file']) ? $file['file'] : (isset($file['file_path']) ? $file['file_path'] : '');

if (!empty($file_path) && file_exists($file_path)) {
    // Use 'name' key from file array, fallback to basename
    $file_name = isset($file['name']) ? $file['name'] : basename($file_path);
    $upload_result = $dropbox->upload_file(
        $file_path,
        $dropbox_folder_path,
        $file_name
    );
}
```

Explanation:
The new Dropbox integration code processes file paths from `$this->file_upload_info['mf-file-upload']` without visible input validation. While `file_exists()` provides some protection, there's no sanitization preventing path traversal sequences (e.g., `../../../etc/passwd`). The code trusts the file path from the file upload info structure. This depends on whether `file_upload_info` is properly validated upstream - if an attacker can control file paths in that structure, they could access arbitrary files on the server. The code should validate that paths are within expected directories.

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes).

--- cache/metform_4.1.0/core/forms/views/modal-editor.php	2026-01-24 00:21:48.247679467 +0000+++ cache/metform_4.1.1/core/forms/views/modal-editor.php	2026-01-24 00:25:40.474116160 +0000@@ -541,7 +541,72 @@                                     'badge' =>'Pro'
                                 ]);
                             endif; ?>
+                            
+                            <?php if (class_exists(\MetForm_Pro\Base\Package::class) && class_exists('\MetForm_Pro\Core\Integrations\Dropbox\Dropbox_Access_Token')  && (\MetForm\Utils\Util::is_mid_tier() || \MetForm\Utils\Util::is_top_tier())) : ?>
+                                <div class="mf-box-style">
+                                    <div class="mf-input-group">
+                                        <label class="attr-input-label">
+                                            <input type="checkbox" value="1" name="mf_dropbox" class="mf-admin-control-input mf-form-modal_input-dropbox">
+                                            <span><?php esc_html_e('Dropbox:', 'metform'); ?></span>
+                                        </label>
+                                        <span class='mf-input-help'><?php esc_html_e('Integrate dropbox with this form. ', 'metform'); ?><strong><a target="_blank" href="<?php echo esc_url(get_dashboard_url()) . 'admin.php?page=metform-menu-settings#mf-general_options'; ?>"><?php esc_html_e('Configure Dropbox.', 'metform'); ?></a></strong></span>
+                                    </div>
 
+                                    <div class="mf-input-group mf-dropbox-selection" style="margin-bottom: 4px;">
+                                        <label for="attr-input-label" class="attr-input-label"><?php esc_html_e('Folder List:', 'metform'); ?>
+                                            <span class="refresh-icon">
+                                                <svg xmlns="http://www.w3.org/2000/svg" width="14" height="13" fill="none" class="metfrom-btn-refresh-dropbox-folder-list">
+                                                    <?php \MetForm\Utils\Util::metform_content_renderer( $refresh_icon_path); ?>
+                                                </svg>
+                                            </span>
+                                        </label>
+                                        <select class="attr-form-control mf-dropbox-folder-list">
+                                        </select>
+                                        <input type="hidden" name="mf_dropbox_list_id" class="mf-dropbox-folder-list-id attr-form-control" placeholder="<?php esc_html_e('Dropbox list title', 'metform'); ?>">
+                                    </div>
+                                </div>
+                            <?php else:    
+                                mf_dummy_switch_input([
+                                    'label' => esc_html__('Dropbox:', 'metform'),
+                                    'help' => esc_html__('Integrate dropbox with this form.', 'metform'),
+                                    'badge' =>'Pro'
+                                ]);
+                            endif; ?>
+                            <?php if ( class_exists('\MetForm_Pro\Core\Integrations\Google_Drive\MF_Google_Drive') ) : ?>
+                                <div class="mf-box-style">
+                                    <div class="mf-input-group">
+                                        <label class="attr-input-label">
+                                            <input type="checkbox" value="1" name="mf_google_drive" class="mf-admin-control-input mf-form-modal_input-google_drive">
+                                            <span><?php esc_html_e('Google Drive:', 'metform'); ?></span>
+                                        </label>
+                                        <span class='mf-input-help'><?php esc_html_e('Integrate google drive with this form. ', 'metform'); ?><strong><a target="_blank" href="<?php echo esc_url(get_dashboard_url()) . 'admin.php?page=metform-menu-settings#mf-google_sheet_integration'; ?>"><?php esc_html_e('Configure Google Drive.', 'metform'); ?></a></strong></span>
+                                    </div>
+
+                                    <div class="mf-google-drive-folder-selection-div">
+                                        <div class="mf-input-group mf-google-drive-folder-selection mf-form-top-spacing mf-form-bottom-spacing">
+                                            <label for="attr-input-label" class="attr-input-label">
+                                                <span><?php esc_html_e('Folder List:', 'metform'); ?></span>
+                                                <span class="refresh-icon  metfrom-btn-refresh-google-drive-folder-list">
+                                                    <svg xmlns="http://www.w3.org/2000/svg" width="14" height="13" fill="none" class="metfrom-btn-refresh-hubsopt-list">
+                                                        <?php \MetForm\Utils\Util::metform_content_renderer( $refresh_icon_path); ?>
+                                                    </svg>
+                                                </span>
+                                            </label>
+
+                                            <select class="attr-form-control mf-google-drive-folder-list">
+
+                                            </select>
+                                            <input type="hidden" name="mf_google_drive_folder_list_id" class="mf-google-drive-folder-list-id attr-form-control" placeholder="<?php esc_html_e('Google Drive folder list id', 'metform'); ?>">
+                                        </div>
+                                    </div>
+                                </div>
+                            <?php else:    
+                                mf_dummy_switch_input([
+                                    'label' => esc_html__('Google Drive :', 'metform'),
+                                    'help' => esc_html__('Integrate google drive file upload', 'metform'),
+                                    'badge' =>'Pro'
+                                ]);
+                            endif; ?>
                             <?php if (did_action('xpd_metform_pro/plugin_loaded')) :
 
                                 if (class_exists('\MetForm_Pro\Core\Integrations\Mail_Poet')) : ?>

## Security Analysis Results

**Vulnerability Existed: yes**
FALSE POSITIVE

**URL Concatenation Vulnerability - CWE-79 (Cross-Site Scripting) - core/forms/views/modal-editor.php - Lines 552, 582**

**Old Code (Missing):**
This code is new in version 4.1.1, but exhibits the same vulnerable pattern as existing code in the file.

**Fixed Code:**
```php
Line 552: <a target="_blank" href="<?php echo esc_url(get_dashboard_url()) . 'admin.php?page=metform-menu-settings#mf-general_options'; ?>"><?php esc_html_e('Configure Dropbox.', 'metform'); ?></a>

Line 582: <a target="_blank" href="<?php echo esc_url(get_dashboard_url()) . 'admin.php?page=metform-menu-settings#mf-google_sheet_integration'; ?>"><?php esc_html_e('Configure Google Drive.', 'metform'); ?></a>
```

**Explanation:**

The code applies `esc_url()` to `get_dashboard_url()` but then **concatenates unescaped strings** to the result. This is a URL encoding bypass vulnerability.

The issue:
- `esc_url(get_dashboard_url())` escapes the dashboard URL
- The concatenated string `'admin.php?page=...'` is **not escaped** before being appended
- An attacker could potentially inject malicious query parameters if `get_dashboard_url()` can be controlled or if there are vulnerabilities in URL handling

**Correct approach** would be:
```php
href="<?php echo esc_url(get_dashboard_url() . 'admin.php?page=metform-menu-settings#mf-general_options'); ?>"
```

This escapes the entire concatenated URL, not just the first part, ensuring all components are properly URL-encoded.

---

**Vulnerability Existed: not sure**

**Missing Escaping on SVG Content Renderer - CWE-79 (Cross-Site Scripting) - core/forms/views/modal-editor.php - Lines 559, 591**

**Old Code (Missing):**
Not present in previous version (new code).

**Fixed Code:**
```php
Line 559: <?php \MetForm\Utils\Util::metform_content_renderer( $refresh_icon_path); ?>
Line 591: <?php \MetForm\Utils\Util::metform_content_renderer( $refresh_icon_path); ?>
```

**Explanation:**

The `metform_content_renderer()` function is called without visible output escaping. The security depends on:
1. Whether `$refresh_icon_path` is properly sanitized
2. Whether `metform_content_renderer()` applies escaping internally

Without access to the function definition, it's uncertain if this is vulnerable. If `metform_content_renderer()` outputs raw SVG content without sanitization, this could be a stored XSS vector through the `$refresh_icon_path` variable.

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes).