MetForm < 4.1.1 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value

Description

The plugin is vulnerable to Sensitive Information Exposure due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes).