Double Extension Attack Vulnerability in Metform Contact Form Builder

CVE-2023-0714

Summary

The Metform Elementor Contact Form Builder for WordPress is susceptible to an arbitrary file upload vulnerability caused by inadequate file type validation. This issue is present in versions up to and including 3.2.4. Attackers can exploit this weakness by executing a 'double extension' attack, allowing them to upload files disguised with benign extensions while concealing malicious payloads. In certain configurations, this vulnerability may lead to remote code execution, which poses a significant risk to the security of affected WordPress installations. Proper validation and sanitation of file uploads is crucial to mitigate this risk.

References