Information Disclosure in Metform Elementor Contact Form Builder for WordPress

CVE-2023-0688

Summary

The Metform Elementor Contact Form Builder for WordPress presents a vulnerability that enables authenticated attackers with subscriber-level access or higher to exploit the 'mf_thankyou' shortcode. This flaw allows the unauthorized retrieval of sensitive data related to form submissions, including payment statuses and transaction IDs. Users of versions up to and including 3.3.1 are particularly at risk, highlighting the importance of updating to secure versions to protect sensitive information from potential exposure.

References