ReCaptcha Bypass in Metform Elementor Contact Form Builder Plugin for WordPress
CVE-2023-0085

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Metform Elementor Contact Form Builder – Flexible And Design-friendly Contact Form Builder Plugin For WordPress
Vendor
CVE Published:
2 March 2023

Summary

The Metform Elementor Contact Form Builder plugin for WordPress is susceptible to a reCaptcha bypass that arises from inadequate server-side validation of the captcha data submitted with forms. This vulnerability allows unauthenticated attackers to circumvent reCaptcha protections, potentially enabling automated bots to submit forms maliciously. It is crucial for users of the Metform plugin to ensure they are running the latest versions to mitigate risks associated with this flaw.

Affected Version(s)

Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress * <= 3.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/metform/
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammed El Amin, Chemouri
.