The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Metform_elementor_contact_form_builder | Wpmet | * | 3.3.0 (including) |