CVE-2023-0688 in Metform Elementor Contact Form Builder Plugin
Summary
by MITRE • 06/09/2023
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-0688 affects the Metform Elementor Contact Form Builder plugin for WordPress, representing a critical information disclosure flaw that undermines the security posture of affected systems. This vulnerability specifically targets the 'mf_thankyou' shortcode functionality within plugin versions up to and including 3.3.1, creating an avenue for unauthorized data exposure that could have significant operational implications for organizations relying on this contact form solution.
The technical flaw stems from insufficient access controls and input validation within the plugin's handling of the 'mf_thankyou' shortcode implementation. Attackers with subscriber-level privileges or higher can exploit this weakness to access sensitive form submission data including payment status information and transaction identifiers. This represents a direct violation of the principle of least privilege and demonstrates inadequate authorization checks within the plugin's codebase. The vulnerability allows for unauthorized data retrieval that should normally be restricted to administrators or authorized personnel only.
The operational impact of this information disclosure vulnerability extends beyond simple data exposure, as it provides attackers with potentially sensitive financial information that could be leveraged for further attacks. Payment status details and transaction IDs obtained through this vulnerability could enable attackers to conduct fraudulent activities, perform account takeovers, or facilitate more sophisticated attacks targeting the affected WordPress installations. The compromise of such information undermines the trust model of the contact form system and could result in regulatory compliance violations for organizations handling sensitive customer data.
Security professionals should recognize this vulnerability as aligning with CWE-200 (Information Exposure) and potentially CWE-284 (Improper Access Control) categories, reflecting the core security principles that have been violated within the plugin's implementation. From an ATT&CK framework perspective, this vulnerability maps to techniques involving credential access and defense evasion through information gathering activities, as attackers can systematically collect sensitive data without raising immediate detection flags. The vulnerability's exploitation requires minimal privileges and provides substantial information gain, making it particularly attractive to threat actors.
Organizations should implement immediate mitigations including upgrading to the patched version of the Metform Elementor Contact Form Builder plugin, reviewing user permissions to ensure appropriate access controls are in place, and monitoring for unauthorized access attempts. Network-based detection measures should be deployed to identify potential exploitation attempts, while regular security audits should verify that similar access control flaws do not exist within other plugin components. System administrators should also consider implementing additional monitoring for sensitive data access patterns and establish incident response procedures to address potential exploitation of this vulnerability.