The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:37
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.3 |
| References | () https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 - Patch | |
| References | () https://plugins.trac.wordpress.org/changeset/2907471/ - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve - Third Party Advisory |
07 Nov 2023, 04:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
14 Jun 2023, 14:58
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:* | |
| First Time |
Wpmet metform Elementor Contact Form Builder
Wpmet |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve - Third Party Advisory | |
| References | (MISC) https://plugins.trac.wordpress.org/changeset/2907471/ - Patch | |
| References | (MISC) https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 - Patch |
09 Jun 2023, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-09 06:15
Updated : 2024-11-21 07:37
NVD link : CVE-2023-0721
Mitre link : CVE-2023-0721
CVE.ORG link : CVE-2023-0721
JSON object : View
Products Affected
wpmet
- metform_elementor_contact_form_builder
CWE
No CWE.