This vulnerability (CVE-2026-24610) in MetForm Pro (<=3.9.1) is classified as CWE-862, indicating missing authorization or broken access control. It allows users with subscriber-level privileges to perform actions beyond their intended permissions, resulting in limited integrity impact. The CVSS 3.1 base score is 4.3 (medium), with network attack vector, low attack complexity, requiring low privileges and no user interaction. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

The vulnerability allows an attacker with subscriber-level access to bypass authorization controls, potentially modifying data or performing unauthorized actions that affect data integrity. There is no impact on confidentiality or availability according to the CVSS vector. The overall impact is limited to integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor vendor communications for updates and consider restricting subscriber privileges where possible until a fix is available.