by Kastro
Paper/Archive/CVE-2023-0714

CVE-2023-0714

roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor — Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.5.615 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extension but ending with a benign extension, which may make remote code execution possible in some configurations.

Affected

ProductAffectedFixed inSource
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor≤ 3.2.4–CNA
metform_elementor_contact_form_builder≤ 3.2.4–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Wordfence (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/697ce433-f321-4977-a2ad-68369d9ce9c3?source=cverefplugins.trac.wordpress.org/browser/metform/trunk/core/entries/file-data-validation.php?rev=2746287refplugins.trac.wordpress.org/changeset/2896914