CVE-2023-0691
published 2023-06-09CVE-2023-0691: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.60%
44.4th percentile
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wpmet | metform_elementor_contact_form_builder | <= 3.3.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress Shortcode information disclosure (ID 2910040)
vuldb·2026-04-09·CVSS 4.3
CVE-2023-0691 [MEDIUM] Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress Shortcode information disclosure (ID 2910040)
A vulnerability was found in Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress. It has been classified as problematic. The impacted element is an unknown function of the component Shortcode Handler. Performing a manipulation results in information disclosure.
This vulnerability is reported as CVE-2023-0691. The attack is possible to be carried out remotely. No exploit exists.
GHSA
GHSA-m5hc-39ff-vm5g: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, a
ghsa_unreviewed·2023-06-09
CVE-2023-0691 [MEDIUM] CWE-639 GHSA-m5hc-39ff-vm5g: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, a
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078https://plugins.trac.wordpress.org/changeset/2910040/https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc4b815-dc05-4270-bf7a-3b01622739d7?source=cvehttps://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078https://plugins.trac.wordpress.org/changeset/2910040/https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc4b815-dc05-4270-bf7a-3b01622739d7?source=cve
2023-06-09
Published