Now officially on WordPress.org

CVE Database / CVE-2023-0688

CVE · Medium

CVE-2023-0688 — MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2023-0688, CVE-2023-0691, CVE-2023-0692, CVE-2023-0693, CVE-2023-0694 MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.2 Authorization Bypass Through User-Controlled Key Medium 6.5 < 3.3.2 3.3.2 2023-06-08 —

CVE-2023-0688, CVE-2023-0691, CVE-2023-0692, CVE-2023-0693, CVE-2023-0694

The MetForm plugin for WordPress versions up to 3.3.1 contains an information disclosure vulnerability in the 'mf_thankyou' shortcode that allows authenticated users with subscriber-level access or higher to view sensitive form submission details such as payment status and transaction identifiers.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings