CVE-2023-0692: Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mfpaymentstatus' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-0692.
What is the severity of CVE-2023-0692?
The severity of CVE-2023-0692 is medium with a severity value of 4.3.
Which software versions are affected by CVE-2023-0692?
Versions up to and including 3.3.1 of the Metform Elementor Contact Form Builder for WordPress are affected by CVE-2023-0692.
How can an attacker exploit CVE-2023-0692?
Authenticated attackers with subscriber-level capabilities or above can exploit CVE-2023-0692 via the 'mf_payment_status' shortcode to obtain sensitive information.
Is there a fix available for CVE-2023-0692?
At the time of writing, there is no available fix for CVE-2023-0692. It is recommended to update to a patched version once it becomes available.