CVE-2023-0689: Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mffirstname' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, including the submitter's first name.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-0689?
CVE-2023-0689 is a vulnerability in the Metform Elementor Contact Form Builder plugin for WordPress that allows authenticated attackers to obtain sensitive information through the 'mf_first_name' shortcode.
What is the severity of CVE-2023-0689?
CVE-2023-0689 has a severity of 4.3 (medium).
How does CVE-2023-0689 impact the Metform Elementor Contact Form Builder plugin?
CVE-2023-0689 enables attackers with subscriber-level capabilities or above to gather sensitive information from the plugin.
Is there a fix available for CVE-2023-0689?
Yes, users should update to version 3.3.2 or later of the Metform Elementor Contact Form Builder plugin to fix CVE-2023-0689.
Where can I find more information about CVE-2023-0689?
Additional information about CVE-2023-0689 can be found at the following links: [Link 1], [Link 2], [Link 3].