CVE-2023-0694CWE-639

Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode

Medium · published June 9, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00659 · 50.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-06-09T05:33Z
EPSS history
Timeline
  • 09 JUN 05:33Z
    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
    cvelistv5