PT-2023-16465 · WordPress · Metform Elementor Contact Form Builder

Ram + 1 · Published 2023-06-09 · Updated 2023-06-14 · CVE-2023-0708

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.0

Description The issue allows authenticated attackers with contributor-level permissions or above to inject arbitrary web scripts in pages using the mf first name shortcode. This occurs because the shortcode echoes unescaped form submissions, enabling the injection of scripts that will execute when a victim visits a page containing the shortcode and the submission id is present in the query string. The script is stored in the site database, and execution requires user interaction, such as visiting a crafted link with the form entry id.

Recommendations For Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.0, consider disabling the use of the mf first name shortcode until a patch is available to prevent the injection of arbitrary web scripts. Additionally, restrict access to form submissions and limit contributor-level permissions to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0708

Affected Products

Metform Elementor Contact Form Builder

References · 5

• https://osv.dev/vulnerability/CVE-2023-0708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0708 · Security Note
• https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 · Patch
• https://plugins.trac.wordpress.org/changeset/2907471 · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/ae7549db-9a4b-4dee-8023-d7863dc3b4c8?source=cve · Note