CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.3.1 contain an authorization flaw that allows authenticated users with low privileges to access sensitive information they should not see. The vulnerability requires a valid user account but no special interaction. Site administrators should update to a version newer than 3.3.1 to prevent unauthorized data disclosure.
What an attacker can do
Read sensitive data they don't have permission to access.
Potential impact on your site
User data or form submissions may be exposed to unauthorized site users.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
