CVE-2023-0721

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0721
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

8.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 Patch
https://plugins.trac.wordpress.org/changeset/2907471/ Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 Patch
https://plugins.trac.wordpress.org/changeset/2907471/ Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 07:37

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 - Patch () https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 - Patch
References () https://plugins.trac.wordpress.org/changeset/2907471/ - Patch () https://plugins.trac.wordpress.org/changeset/2907471/ - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve - Third Party Advisory
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 8.3

14 Jun 2023, 14:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve - (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve - Third Party Advisory
References (MISC) https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 - (MISC) https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078 - Patch
References (MISC) https://plugins.trac.wordpress.org/changeset/2907471/ - (MISC) https://plugins.trac.wordpress.org/changeset/2907471/ - Patch
CPE cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*

09 Jun 2023, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-09 06:15

Updated : 2024-11-21 07:37

NVD link : CVE-2023-0721

Mitre link : CVE-2023-0721

CVE.ORG link : CVE-2023-0721

JSON object : View

Products Affected

wpmet

  • metform_elementor_contact_form_builder
CWE

No CWE.