CVE Database /
CVE-2023-2517
CVE · Medium
CVE-2023-2517 — MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-2517
|
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform] < 3.3.3 |
Cross-Site Request Forgery (CSRF) |
Medium
4.3
|
< 3.3.3
|
3.3.3 |
2023-06-22 |
—
|
CVE-2023-2517
The MetForm plugin for WordPress versions 3.3.2 and earlier contains a cross-site request forgery vulnerability in the permalink_setup function due to inadequate nonce validation. An unauthenticated attacker can modify the site's permalink structure by inducing an administrator to click a malicious link if no nonce is present, since the plugin only validates the nonce when one is provided rather than requiring it unconditionally. This flaw allows attackers to alter critical site settings through forged requests. The vulnerability was fixed in version 3.3.3.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings