CVE-2023-0688
published 2023-06-09CVE-2023-0688: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and…
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.73%
49.8th percentile
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wpmet | metform_elementor_contact_form_builder | <= 3.3.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress Shortcode information disclosure (ID 2910040)
vuldb·2026-04-09·CVSS 6.5
CVE-2023-0688 [MEDIUM] Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress Shortcode information disclosure (ID 2910040)
A vulnerability has been found in Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress and classified as problematic. Impacted is an unknown function of the component Shortcode Handler. This manipulation causes information disclosure.
This vulnerability is registered as CVE-2023-0688. Remote exploitation of the attack is possible. No exploit is available.
GHSA
GHSA-8px7-5x6r-5h2f: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, an
ghsa_unreviewed·2023-06-09
CVE-2023-0688 [MEDIUM] CWE-639 GHSA-8px7-5x6r-5h2f: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, an
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078https://plugins.trac.wordpress.org/changeset/2910040/https://www.wordfence.com/threat-intel/vulnerabilities/id/81fc41a4-9206-404c-bd5b-821c77ff3593?source=cvehttps://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078https://plugins.trac.wordpress.org/changeset/2910040/https://www.wordfence.com/threat-intel/vulnerabilities/id/81fc41a4-9206-404c-bd5b-821c77ff3593?source=cve
2023-06-09
Published