CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0694 – Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
https://notcve.org/view.php?id=CVE-2023-0694
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission. • https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 https://plugins.trac.wordpress.org/changeset/2910040 https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8b194c-371f-4adc-98fa-8f4e47a38ee7?source=cve • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0721 – Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
https://notcve.org/view.php?id=CVE-2023-0721
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. • https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 https://plugins.trac.wordpress.org/changeset/2907471 https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0688 – Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
https://notcve.org/view.php?id=CVE-2023-0688
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID. • https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 https://plugins.trac.wordpress.org/changeset/2910040 https://www.wordfence.com/threat-intel/vulnerabilities/id/81fc41a4-9206-404c-bd5b-821c77ff3593?source=cve • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0692 – Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
https://notcve.org/view.php?id=CVE-2023-0692
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions. • https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 https://plugins.trac.wordpress.org/changeset/2910040 https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd85ff2-6607-4ac8-b91c-88f6f2fa6c56?source=cve • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0693 – Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
https://notcve.org/view.php?id=CVE-2023-0693
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment. • https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 https://plugins.trac.wordpress.org/changeset/2910040 https://www.wordfence.com/threat-intel/vulnerabilities/id/1f33a8db-7cd0-4a53-b2c1-cd5b7cd16214?source=cve • CWE-639: Authorization Bypass Through User-Controlled Key •