CVE-2024-4266

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-4266
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.php#L1019 Product
https://plugins.trac.wordpress.org/changeset/3099977/ Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.php#L1019 Product
https://plugins.trac.wordpress.org/changeset/3099977/ Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*
History

26 Feb 2025, 20:58

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.php#L1019 - () https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.php#L1019 - Product
References () https://plugins.trac.wordpress.org/changeset/3099977/ - () https://plugins.trac.wordpress.org/changeset/3099977/ - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=cve - Third Party Advisory
First Time Wpmet
Wpmet metform Elementor Contact Form Builder
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*

21 Nov 2024, 09:42

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.php#L1019 - () https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/action.php#L1019 -
References () https://plugins.trac.wordpress.org/changeset/3099977/ - () https://plugins.trac.wordpress.org/changeset/3099977/ -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=cve -

11 Jun 2024, 13:54

Type Values Removed Values Added
Summary
  • (es) El complemento MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor para WordPress es vulnerable a la exposición de información confidencial en versiones hasta la 3.8.8 incluida a través de la función 'handle_file'. Esto puede permitir a atacantes no autenticados extraer datos confidenciales, como información de identificación personal, de archivos cargados por los usuarios.

11 Jun 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-11 08:15

Updated : 2025-02-26 20:58

NVD link : CVE-2024-4266

Mitre link : CVE-2024-4266

CVE.ORG link : CVE-2024-4266

JSON object : View

Products Affected

wpmet

  • metform_elementor_contact_form_builder
CWE
NVD-CWE-noinfo