CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.3.1 contain an authorization flaw that allows authenticated users to access sensitive form data they should not be able to view. An attacker with a low-privilege account can read confidential information submitted through forms, such as survey responses or quiz answers. This affects all installations using the vulnerable version.
What an attacker can do
Read sensitive form submission data and user responses without proper authorization.
Potential impact on your site
Form submissions and user data may be exposed to unauthorized site users with basic accounts.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
