CVE-2023-0085mediumCWE-693

CVE-2023-0085: medium-severity vulnerability in roxnor MetForm – Contact Form, Survey, Quiz, &…

Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass

Published · Updated

Follow this CVE+ Monitor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.7%
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
roxnor · MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Related CVEs — roxnor MetForm – Contact Form, Survey, Quiz, &…

In the same product, most dangerous first.

CVE-2023-0084HIGHMetform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 28.6%CVE-2022-1442HIGHMetform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information DisclosureEPSS 8.8%CVE-2023-0714HIGHMetform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File UploadEPSS 1.0%CVE-2023-0688MEDIUMMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcodeEPSS 0.7%CVE-2023-0721HIGHMetform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV InjectionEPSS 0.7%CVE-2023-0693MEDIUMMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcodeEPSS 0.7%