CVE-2023-0085 Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass

What is CVE-2023-0085?

CVE-2023-0085 is a medium-severity vulnerability in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor, published on 2 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.

Weakness: CWE-693

Which versions are affected by CVE-2023-0085?

It affects 1 product.

Products include Wpmet Metform Elementor Contact Form Builder.

How do I fix CVE-2023-0085?

No fix has been published for CVE-2023-0085 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-0085 being exploited?

There is no known exploitation of CVE-2023-0085 in the wild and no public exploit code.

Other vulnerabilities in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

• CVE-2023-0721 Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection High 8.3
• CVE-2023-0714 Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload High 8.1
• CVE-2022-1442 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure High 7.5
• CVE-2023-0084 Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2023-0688 Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p6cm-7qf6-8x4p.