Login Request a demo
Medium severity · published Jun 9, 2023
CVE-2023-0694
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1
4.3
CVSS
0.7%
EPSS
No
On KEV
Description
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Metform Elementor Contact Form Builder · Wpmet
through 3.3.1 · source: NVD
Affected product
ME
Metform Elementor Contact Form Builder
Wpmet
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0694
Patch
https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078
Patch
https://plugins.trac.wordpress.org/changeset/2910040/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8b194c-371f-4adc-98fa-8f4e47a38ee7?source=cve
More from Metform Elementor Contact Form Builder
9.8
CVE-2023-50903
WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability
9.8
CVE-2023-0714
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
8.8
CVE-2024-33570
WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability
7.8
CVE-2023-0721
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0
7.5
CVE-2024-4266
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure