CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
What the vulnerability does
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Explanation of Vulnerability in Simple Terms
MetForm versions up to 3.3.0 contain a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires the victim to visit a malicious link or page, and the impact can extend beyond the form plugin itself to affect the wider site. Update to a version newer than 3.3.0 to resolve this issue.
What an attacker can do
Read sensitive data, modify site content, or disrupt the site's availability.
Potential impact on your site
Visitor data may be exposed, form submissions could be altered, or the site may become unavailable.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
