PT-2023-16000 · WordPress · Metform Elementor Contact Form Builder

Mohammed El Amin · Published 2023-03-02 · Updated 2023-03-10 · CVE-2023-0085

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder plugin for WordPress versions up to, and including, 3.2.1

Description The issue is related to insufficient server-side checking of the captcha value submitted during form submission, allowing unauthenticated attackers to bypass Captcha restrictions. This enables attackers to utilize bots to submit forms.

Recommendations For versions up to, and including, 3.2.1, update to a version higher than 3.2.1 to resolve the issue.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2023-0085

Affected Products

Metform Elementor Contact Form Builder

References · 6

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2868889%40metform&new=2868889%40metform&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-0085 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0085 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9?source=cve · Note
• https://wordpress.org/plugins/metform · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9 · Note