CVE-2023-0692 - Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode

Back Back to CVE browser

MEDIUM

Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode

Published Jun 9, 2023

4.3

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.

Affected products

Vendor Roxnor Product MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=3.3.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Roxnor

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

unaffected

Version	Status	Constraints
0	affected	<=3.3.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

Link	Providers	Tags
https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078		Patch
https://plugins.trac.wordpress.org/changeset/2910040/		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd85ff2-6607-4ac8-b91c-88f6f2fa6c56?source=cve		Third Party Advisory