漏洞描述
WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
gist.github.comhttps://gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bf↗wpscan.comhttps://wpscan.com/vulnerability/9f3fcdd4-9ddc-45d5-a4af-e58634813c2b↗wordpress.orghttps://wordpress.org/plugins/metform/advanced/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-1442↗plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.php↗