CVE-2023-0692
published 2023-06-09CVE-2023-0692: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.60%
44.4th percentile
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wpmet | metform_elementor_contact_form_builder | <= 3.3.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress Shortcode information disclosure (ID 2910040)
vuldb·2026-04-09·CVSS 4.3
CVE-2023-0692 [MEDIUM] Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress Shortcode information disclosure (ID 2910040)
A vulnerability was found in Metform Elementor Contact Form Builder Plugin up to 3.3.1 on WordPress. It has been declared as problematic. This affects an unknown function of the component Shortcode Handler. Executing a manipulation can lead to information disclosure.
This vulnerability appears as CVE-2023-0692. The attack may be performed from remote. There is no available exploit.
GHSA
GHSA-2w3f-x9p7-9w42: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up
ghsa_unreviewed·2023-06-09
CVE-2023-0692 [MEDIUM] CWE-639 GHSA-2w3f-x9p7-9w42: The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078https://plugins.trac.wordpress.org/changeset/2910040/https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd85ff2-6607-4ac8-b91c-88f6f2fa6c56?source=cvehttps://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078https://plugins.trac.wordpress.org/changeset/2910040/https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd85ff2-6607-4ac8-b91c-88f6f2fa6c56?source=cve
2023-06-09
Published