CVE-2023-0689 in Metform Elementor Contact Form Builder Plugin
Summary
by MITRE • 08/31/2023
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, including the submitter's first name.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-0689 affects the Metform Elementor Contact Form Builder plugin for WordPress, representing a critical information disclosure weakness that undermines the confidentiality of user data. This vulnerability specifically manifests through the 'mf_first_name' shortcode functionality within the plugin's codebase, where authenticated users with subscriber-level privileges or higher can exploit the flaw to access sensitive information from arbitrary form submissions. The affected versions include all releases up to and including 3.3.1, indicating a widespread exposure across multiple plugin iterations that have not received adequate security hardening.
The technical flaw stems from insufficient input validation and output sanitization within the plugin's form processing mechanism. When the 'mf_first_name' shortcode is utilized, the system fails to properly restrict access to form submission data, allowing unauthorized users to query and retrieve information about submissions they should not have access to. This represents a classic privilege escalation vulnerability where the system does not adequately verify user permissions before exposing sensitive data elements. The vulnerability operates at the application layer and specifically targets the plugin's shortcode execution engine, which processes user requests and returns form data without proper access controls.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to gather potentially sensitive personal information from form submissions. In environments where contact forms collect personal data, this exposure could lead to privacy violations and compliance breaches, particularly in regulated industries such as healthcare, finance, or education. Attackers can systematically harvest first names from multiple form submissions, potentially building profiles of users or identifying patterns in submission behavior. The vulnerability affects not just individual user privacy but also organizational data protection strategies and overall security posture, as it allows for passive reconnaissance of form submission data without requiring elevated privileges beyond subscriber access.
Mitigation strategies for CVE-2023-0689 should prioritize immediate plugin updates to versions that address the information disclosure vulnerability, as this represents the most effective defense mechanism against exploitation. System administrators should implement role-based access controls to limit subscriber capabilities where possible, ensuring that users with minimal privileges cannot access data they do not need for their legitimate functions. Additionally, network monitoring should be enhanced to detect unusual patterns of shortcode usage that might indicate exploitation attempts. Organizations should also consider implementing data loss prevention measures and regular security audits of WordPress plugins to identify similar vulnerabilities. This vulnerability aligns with CWE-200, which addresses information exposure, and could be categorized under ATT&CK technique T1213.002 for Data from Information Repositories, emphasizing the importance of proper access controls and data protection measures in web applications.