CVE-2023-0085

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-00866.5The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This CVE-2023-00874.8The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ p CVE-2023-00888.8The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is du CVE-2023-00898.8The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code CVE-2023-00909.8The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote co CVE-2023-00913.8A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw CVE-2023-00924.9An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from th CVE-2023-00938.8Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrow CVE-2023-00945.4The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them b CVE-2023-00955.4The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a pa CVE-2023-00965.4The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/p CVE-2023-00975.4The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options be