CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.3.1 contain an authorization flaw that allows authenticated users to access sensitive form data they should not be able to view. An attacker with a low-privilege account can read confidential information submitted through forms, such as survey responses or quiz answers. This affects all installations using the vulnerable version.
What an attacker can do
Read sensitive form submissions and user data they don't have permission to access.
Potential impact on your site
Form data privacy is compromised; users' survey responses, quiz answers, and other submissions may be exposed to unauthorized site users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
