CVE-2023-0694 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode

What is CVE-2023-0694?

CVE-2023-0694 is a medium-severity vulnerability in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor, published on 9 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.

Weakness: CWE-639

Which versions are affected by CVE-2023-0694?

It affects 1 product.

Products include Wpmet Metform Elementor Contact Form Builder.

How do I fix CVE-2023-0694?

No fix has been published for CVE-2023-0694 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-0694 being exploited?

There is no known exploitation of CVE-2023-0694 in the wild and no public exploit code.

Other vulnerabilities in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

• CVE-2023-0721 Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection High 8.3
• CVE-2023-0714 Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload High 8.1
• CVE-2022-1442 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure High 7.5
• CVE-2023-0084 Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2023-0688 Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fj32-p25w-q5jm.