CVE-2023-0688: Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mfthankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-0688.
What is the severity of CVE-2023-0688?
The severity of CVE-2023-0688 is medium (6.5).
How does CVE-2023-0688 affect the Metform Elementor Contact Form Builder for WordPress?
CVE-2023-0688 allows authenticated attackers with subscriber-level capabilities or above to obtain sensitive information about form submissions in versions up to, and including, 3.3.1.
How can I fix the CVE-2023-0688 vulnerability?
To fix the CVE-2023-0688 vulnerability, update the Metform Elementor Contact Form Builder plugin to a version above 3.3.1.
Where can I find more information about the CVE-2023-0688 vulnerability?
More information about the CVE-2023-0688 vulnerability can be found at the following references: [Reference 1](https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078), [Reference 2](https://plugins.trac.wordpress.org/changeset/2910040/), [Reference 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/81fc41a4-9206-404c-bd5b-821c77ff3593?source=cve).