CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.3.1 allow authenticated users with low privileges to read sensitive data from the plugin. An attacker with a basic user account can access information they should not be able to view. The vulnerability requires network access and an active login but no additional user interaction. Update to a version newer than 3.3.1 to resolve this issue.
What an attacker can do
Read sensitive data accessible through the plugin with a low-privilege user account.
Potential impact on your site
User data or form submissions may be exposed to authenticated users who should not have access.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site; network access required.
Key dates
External resources
Related vulnerabilities
