CSV Injection Vulnerability in Metform Elementor Contact Form Builder for WordPress
CVE-2023-0721

8.3HIGH

Key Information:

Vendor
Wordpress
Status
Metform Elementor Contact Form Builder – Flexible And Design-friendly Contact Form Builder Plugin For WordPress
Vendor
CVE Published:
9 June 2023

Summary

The Metform Elementor Contact Form Builder plugin for WordPress contains a vulnerability that allows unauthenticated attackers to insert untrusted input into CSV files during export. Versions up to and including 3.3.0 are affected. When these manipulated CSV files are downloaded and opened in a vulnerable environment, they can lead to unintended code execution, potentially compromising system security.

Affected Version(s)

Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress * <= 3.3.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/metform/trunk/...
https://plugins.trac.wordpress.org/changeset/2907471/

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ramuel Gall
.