Cross-Site Request Forgery Vulnerability in Metform Elementor Contact Form Builder Plugin for WordPress

CVE-2023-6788

Summary

The Metform Elementor Contact Form Builder plugin for WordPress suffers from a Cross-Site Request Forgery vulnerability affecting all versions up to and including 3.8.1. This flaw arises from inadequate nonce validation in the contents function, allowing unauthenticated attackers to manipulate critical application options. By tricking a site administrator into making a malicious request, an attacker can connect a rogue Hubspot account to the compromised site, enabling them to capture sensitive leads and contacts.

References