PT-2023-16466 · WordPress · Metform Elementor Contact Form Builder

Ram + 1 · Published 2023-06-09 · Updated 2023-06-14 · CVE-2023-0709

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.3.0

Description The issue allows authenticated attackers with contributor-level permissions or above to inject arbitrary web scripts in pages. This is achieved by using the 'mf last name' shortcode to echo unescaped form submissions. The script is stored in the site database and will execute when a victim visits a page containing the shortcode with the submission id present in the query string. Note that user interaction is required, as the victim must visit a crafted link with the form entry id for the JavaScript to execute.

Recommendations For versions up to, and including, 3.3.0, update to a version higher than 3.3.0 to resolve the issue. As a temporary workaround, consider disabling the use of the 'mf last name' shortcode until a patch is available. Restrict access to pages that contain the shortcode to minimize the risk of exploitation. Avoid using the shortcode in pages that can be accessed by untrusted users until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0709

Affected Products

Metform Elementor Contact Form Builder

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-0709 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0709 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078 · Patch
• https://plugins.trac.wordpress.org/changeset/2907471 · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/25200656-a6a2-42f2-a607-26d4ff502cbf?source=cve · Note