Lucene search

WordfenceCVE-2023-0693

HistoryJun 09, 2023 - 6:15 a.m.

CVE-2023-0693

2023-06-0906:15:51

Wordfence

web.nvd.nist.gov

metform

elementor

contact form builder

wordpress

cve-2023-0693

information disclosure

vulnerability

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

34.6%

JSON

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the ‘mf_transaction_id’ shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.

Affected configurations

Nvd

Vulners

Node

wpmetmetform_elementor_contact_form_builderRange≤3.3.1wordpress

VendorProductVersionCPE
wpmetmetform_elementor_contact_form_builder*cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpmet	metform_elementor_contact_form_builder	*	cpe:2.3:a:wpmet:metform_elementor_contact_form_builder::::::wordpress::*

CNA Affected

[
  {
    "vendor": "xpeedstudio",
    "product": "Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078

plugins.trac.wordpress.org/changeset/2910040/

www.wordfence.com/threat-intel/vulnerabilities/id/1f33a8db-7cd0-4a53-b2c1-cd5b7cd16214?source=cve

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

34.6%

JSON

Related for CVE-2023-0693