Cross-Site Request Forgery Vulnerability in Metform Elementor Contact Form Builder Plugin for WordPress
CVE-2023-6788
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 January 2024
What is CVE-2023-6788?
The Metform Elementor Contact Form Builder plugin for WordPress suffers from a Cross-Site Request Forgery vulnerability affecting all versions up to and including 3.8.1. This flaw arises from inadequate nonce validation in the contents function, allowing unauthenticated attackers to manipulate critical application options. By tricking a site administrator into making a malicious request, an attacker can connect a rogue Hubspot account to the compromised site, enabling them to capture sensitive leads and contacts.
Affected Version(s)
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor 0 <= 3.8.1