CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extension but ending with a benign extension, which may make remote code execution possible in some configurations.
Explanation of Vulnerability in Simple Terms
MetForm allows unauthenticated attackers to upload files without restriction, potentially enabling them to run malicious code on the site. The vulnerability affects all versions up to 3.2.4. An attacker can exploit this over the network without needing special conditions or user interaction. Site administrators should update immediately to a patched version.
What an attacker can do
Upload and execute malicious files on the site without authentication.
Potential impact on your site
Attackers can run arbitrary code, steal data, modify content, or take over the site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
