CVE-2024-4266: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handlefile' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4266?
CVE-2024-4266 has a high severity due to its potential for sensitive information exposure.
How do I fix CVE-2024-4266?
To fix CVE-2024-4266, upgrade the MetForm – Contact Form, Survey, Quiz, & Custom Form Builder plugin to version 3.8.9 or later.
Who is affected by CVE-2024-4266?
CVE-2024-4266 affects users of the MetForm plugin for WordPress, specifically those using versions up to and including 3.8.8.
What can attackers do with CVE-2024-4266?
Attackers can exploit CVE-2024-4266 to extract sensitive data from the application without authentication.
When was CVE-2024-4266 disclosed?
CVE-2024-4266 was disclosed in the year 2024 and affects multiple versions of the MetForm plugin.