CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.3.1 contain an authorization flaw that allows authenticated users with low privileges to access sensitive data they should not see. An attacker with a basic user account can read confidential information stored in the plugin without needing additional interaction. Site administrators should update to a version newer than 3.3.1 to close this access control gap.
What an attacker can do
Read sensitive data and confidential information they are not authorized to access.
Potential impact on your site
User data and confidential information may be exposed to any authenticated user, even those with minimal permissions.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no special interaction required.
Key dates
External resources
Related vulnerabilities
