CVE-2023-6788 Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery
Unauthenticated attackers can trick administrators into updating Hubspot integration settings, allowing attackers to steal leads and contacts from the victim site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-6788?
CVE-2023-6788 is a medium-severity vulnerability in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor, published on 9 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it possible for unauthenticated attackers to update the options "mf_hubsopt_token", "mf_hubsopt_refresh_token", "mf_hubsopt_token_type", and "mf_hubsopt_expires_in" via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This would allow an attacker to connect their own Hubspot account to a victim site's metform to obtain leads and contacts.
Weakness: CWE-352
Which versions are affected by CVE-2023-6788?
It affects 1 product.
Products include Wpmet Metform Elementor Contact Form Builder.
How do I fix CVE-2023-6788?
No fix has been published for CVE-2023-6788 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6788 being exploited?
There is no known exploitation of CVE-2023-6788 in the wild and no public exploit code.
Other vulnerabilities in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
- CVE-2023-0721 Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
- CVE-2023-0714 Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload
- CVE-2022-1442 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
- CVE-2023-0084 Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2023-0688 Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Sources
Also known as GHSA-5c29-2r8j-8727.