CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.2.1 contain a vulnerability that allows attackers to modify form data without authentication. The vulnerability requires only network access and no user interaction. An attacker can alter submitted form information, potentially affecting data integrity for contact forms, surveys, and quizzes built with this Elementor plugin.
What an attacker can do
Modify form submission data without logging in.
Potential impact on your site
Form submissions may be altered or corrupted, affecting data reliability for surveys, quizzes, and contact forms.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
