CVE-2023-6788

The MetForm Elementor Contact Form Builder plugin for WordPress through version 3.8.1 contains a cross-site request forgery vulnerability in the contents function due to inadequate nonce validation. An unauthenticated attacker can exploit this flaw by deceiving a site administrator into clicking a malicious link, enabling the attacker to modify four HubSpot-related options including the API token and refresh token. This allows the attacker to link their own HubSpot account to the victim's installation and gain unauthorized access to collected leads and contact information.

Based on public CVE data (MITRE/NVD).