CVE-2024-4266 Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

What is CVE-2024-4266?

CVE-2024-4266 is a medium-severity vulnerability in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor, published on 11 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.

Weakness: CWE-200

Which versions are affected by CVE-2024-4266?

It affects 1 product.

Products include Wpmet Metform Elementor Contact Form Builder.

How do I fix CVE-2024-4266?

No fix has been published for CVE-2024-4266 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-4266 being exploited?

There is no known exploitation of CVE-2024-4266 in the wild and no public exploit code.

Other vulnerabilities in roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

• CVE-2023-0721 Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection High 8.3
• CVE-2023-0714 Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload High 8.1
• CVE-2022-1442 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure High 7.5
• CVE-2023-0084 Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2023-0688 Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gxqg-7fh5-vvwm.