Information Disclosure in Metform Elementor Contact Form Builder for WordPress
CVE-2023-0688
6.5MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 9 June 2023
What is CVE-2023-0688?
The Metform Elementor Contact Form Builder for WordPress presents a vulnerability that enables authenticated attackers with subscriber-level access or higher to exploit the 'mf_thankyou' shortcode. This flaw allows the unauthorized retrieval of sensitive data related to form submissions, including payment statuses and transaction IDs. Users of versions up to and including 3.3.1 are particularly at risk, highlighting the importance of updating to secure versions to protect sensitive information from potential exposure.
Affected Version(s)
Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress * <= 3.3.1