PT-2023-16000 · WordPress · Metform Elementor Contact Form Builder

Mohammed El Amin · Publicado 2023-03-02 · Atualizado 2023-03-10 · CVE-2023-0085

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder plugin for WordPress versions up to, and including, 3.2.1

Description The issue is related to insufficient server-side checking of the captcha value submitted during form submission, allowing unauthenticated attackers to bypass Captcha restrictions. This enables attackers to utilize bots to submit forms.

Recommendations For versions up to, and including, 3.2.1, update to a version higher than 3.2.1 to resolve the issue.

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

Identificadores relacionados

CVE-2023-0085

Produtos afetados

Metform Elementor Contact Form Builder

Referências · 6

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2868889%40metform&new=2868889%40metform&sfp_email=&sfph_mail= · Correção
• https://wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9?source=cve · Nota
• https://wordpress.org/plugins/metform · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-0085 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0085 · Aviso do Fabricante
• https://wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9 · Nota