CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, including the submitter's first name.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.3.1 contain an authorization flaw that allows authenticated users to access sensitive information they should not see. A logged-in user with low privileges can read data that is restricted to higher-privilege accounts. The vulnerability requires an active user account but no additional user interaction. Update to a version newer than 3.3.1.
What an attacker can do
Read sensitive data restricted to higher-privilege users.
Potential impact on your site
Authenticated users can view restricted information; data confidentiality is at risk.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
