High severity · published Jun 9, 2023
CVE-2023-0721
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0
7.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Metform Elementor Contact Form Builder · Wpmet
through 3.3.0 · source: NVD
Affected product
ME
Metform Elementor Contact Form Builder
Wpmet
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0721
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0721
Patch
https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078
Patch
https://plugins.trac.wordpress.org/changeset/2907471/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve
More from Metform Elementor Contact Form Builder
9.8
CVE-2023-50903
WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability
9.8
CVE-2023-0714
Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
8.8
CVE-2024-33570
WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability
7.5
CVE-2024-4266
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
7.5
CVE-2022-1442
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an…