Information Disclosure in Metform Elementor Contact Form Builder for WordPress
CVE-2023-0691
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 9 June 2023
What is CVE-2023-0691?
The Metform Elementor Contact Form Builder plugin for WordPress exhibits a vulnerability that permits authenticated users with subscriber-level permissions or higher to exploit the 'mf_last_name' shortcode. This flaw enables the disclosure of sensitive information, specifically the last names of individuals who have submitted forms, raising concerns about the privacy and confidentiality of user data.
Affected Version(s)
Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress * <= 3.3.1