Vulnerability · Published Jun 9, 2023 · Assigned by Wordfence
CVE-2023-0694Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor from roxnor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| roxnor | MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor | 0 – through 3.3.1 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N