CVE-2024-33570 Overview
CVE-2024-33570 is a missing authorization vulnerability in the Metform Elementor Contact Form Builder plugin for WordPress, developed by Wpmet (Roxnor). The flaw affects all versions of Metform up to and including 3.8.3. Authenticated attackers with low-level privileges can invoke plugin functionality that lacks proper access control checks, leading to compromise of confidentiality, integrity, and availability. The weakness is classified under CWE-862: Missing Authorization.
Critical Impact
An authenticated attacker with minimal privileges can abuse unrestricted plugin actions to access or manipulate form submissions and configuration data across a WordPress site.
Affected Products
- Wpmet Metform Elementor Contact Form Builder for WordPress
- All versions up to and including 3.8.3
- WordPress sites running the Metform plugin as an Elementor extension
Discovery Timeline
- 2024-05-06 - CVE-2024-33570 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-33570
Vulnerability Analysis
The vulnerability stems from the plugin exposing sensitive actions without validating whether the calling user is authorized to perform them. In WordPress plugin architecture, action handlers registered via admin-ajax.php or REST endpoints must verify user capabilities using functions such as current_user_can(). Metform omits these checks on at least one privileged action path.
An attacker holding any authenticated session, including a subscriber-level account, can send crafted requests that reach these unprotected handlers. The plugin executes the action as though the caller were authorized, bypassing the intended role-based access model. The attack proceeds over the network and requires no user interaction beyond the attacker's own request.
Because Metform manages contact forms, the exposed functionality can touch stored submissions, form configuration, and integration settings. This gives the attacker read and write reach into data that should be restricted to administrators or form editors.
Root Cause
The root cause is broken access control in the plugin's action dispatch layer. Callback functions that mutate or read privileged data do not enforce capability checks or nonce validation consistently. This design gap allows any authenticated principal to invoke the callbacks directly.
Attack Vector
Exploitation requires network access to the target WordPress instance and a valid low-privilege account. Sites that permit open user registration are at higher risk because attackers can self-provision the required subscriber account. The attacker issues an HTTP request to the vulnerable Metform action endpoint with parameters that trigger the unauthorized operation.
No verified proof-of-concept code is public. Technical specifics are available in the Patchstack Security Advisory.
Detection Methods for CVE-2024-33570
Indicators of Compromise
- Unexpected POST requests to admin-ajax.php referencing Metform actions from subscriber or contributor accounts
- Modifications to Metform form entries, settings, or integration credentials without a corresponding administrator session
- New or unfamiliar WordPress user accounts created shortly before Metform-related activity
- Outbound requests from the WordPress host to unfamiliar destinations following Metform action calls
Detection Strategies
- Review WordPress access logs for authenticated requests to Metform endpoints originating from non-privileged users
- Compare Metform form submission tables against expected volume and originator patterns to identify tampering
- Correlate WordPress wp_users and wp_usermeta changes with Metform action invocations in the same time window
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and REST API routes and forward logs to a centralized SIEM
- Alert on any Metform-related action executed by a user whose role is below editor
- Track plugin version inventory across all WordPress sites and flag hosts still running Metform <= 3.8.3
How to Mitigate CVE-2024-33570
Immediate Actions Required
- Update the Metform plugin to a version later than 3.8.3 on all affected WordPress installations
- Audit existing WordPress accounts and remove or disable unused low-privilege users
- Disable open user registration on public sites where subscriber accounts are not required
- Review recent form submissions and plugin configuration changes for signs of tampering
Patch Information
Wpmet has released fixed versions of the Metform plugin that add the missing authorization checks. Administrators should upgrade to the latest available release via the WordPress plugin repository. Consult the Patchstack Vulnerability Database Entry for the fixed version reference.
Workarounds
- Deactivate the Metform plugin until the upgrade can be applied if immediate patching is not possible
- Place a web application firewall rule in front of WordPress to block requests to Metform action names from non-administrator sessions
- Restrict access to /wp-admin/admin-ajax.php at the network layer for known-bad source ranges
- Rotate credentials and API keys stored in Metform integrations after patching
# Configuration example: verify installed Metform version via WP-CLI
wp plugin get metform --field=version
wp plugin update metform
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
