Information Disclosure in Metform Elementor Contact Form Builder for WordPress
CVE-2023-0691
4.3MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 9 June 2023
Summary
The Metform Elementor Contact Form Builder plugin for WordPress exhibits a vulnerability that permits authenticated users with subscriber-level permissions or higher to exploit the 'mf_last_name' shortcode. This flaw enables the disclosure of sensitive information, specifically the last names of individuals who have submitted forms, raising concerns about the privacy and confidentiality of user data.
Affected Version(s)
Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress * <= 3.3.1
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ramuel Gall