CVE-2023-1843 MEDIUM

CVE-2023-1843: Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization

Vendor Roxnor
Product MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Weakness CWE-862 · Missing authorization
Published June 9, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.

Key dates

02Disclosure timeline

June 9, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-62081 WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability CVE-2024-54379 WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability CVE-2023-50373 WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerability CVE-2025-31843 WordPress OpenAI Tools for WordPress & WooCommerce plugin <= 2.2.1 - Broken Access Control vulnerability CVE-2024-53805 WordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerability