CVE-2023-2517

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it possible for unauthenticated attackers to change the permalink structure via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While nonce verification is implemented, verification only takes place when a nonce is provided.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
roxnorMetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor<= 3.3.2

References

Timeline

Published
Jul 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-251708.8PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). WhCVE-2023-251715.9Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denCVE-2023-251725.4Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `teCVE-2023-251737.8containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groupsCVE-2023-251747.8Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentialCVE-2023-251755.5Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information dCVE-2023-251765.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2023-251777.8Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attackeCVE-2023-251789.8Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendCVE-2023-251795.5Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentiaCVE-2023-25186.1The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page whCVE-2023-251819.8A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted