Information Disclosure in Metform Elementor Contact Form Builder for WordPress
CVE-2023-0693
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 June 2023
What is CVE-2023-0693?
The Metform Elementor Contact Form Builder for WordPress has a vulnerability that permits authenticated users with subscriber-level access or higher to exploit the 'mf_transaction_id' shortcode. This vulnerability can lead to unauthorized access to sensitive transaction IDs related to form submissions that include payment information. It affects all versions up to and including 3.3.1, potentially putting user data at risk.
Affected Version(s)
Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress * <= 3.3.1