Information Disclosure Vulnerability in Metform Elementor Contact Form Builder for WordPress

CVE-2023-0689

Summary

The Metform Elementor Contact Form Builder for WordPress is susceptible to an information disclosure vulnerability due to the use of the 'mf_first_name' shortcode. Authenticated users with subscriber-level access or higher can exploit this issue to access sensitive information from arbitrary form submissions, including the submitter's first name. This vulnerability highlights the importance of securing form data and implementing adequate user permissions to prevent unauthorized information access.

References