Login Request a demo
Medium severity · published Mar 2, 2023
CVE-2023-0085
Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor · roxnor
through 3.2.1 · source: vendor
ME
Metform Elementor Contact Form Builder · Wpmet
through 3.2.1 · source: NVD
Affected product
MC
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
roxnor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0085
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2868889%40metform&new=2868889%40metform&sfp_email=&sfph_mail=
Product
https://wordpress.org/plugins/metform/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9
More from MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
9.8
CVE-2023-0714
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
7.8
CVE-2023-0721
Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
7.5
CVE-2024-4266
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
6.5
CVE-2023-0688
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
6.4
CVE-2025-5684
MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element