CVE-2023-50903 is a medium severity missing authorization flaw in Metform, an Elementor contact form builder plugin for WordPress, scored 5.3. Versions up to and including 3.4.0 are affected, and the fix is in 3.4.1. Update Metform to 3.4.1 or later on every site you run.
What's affected
The record lists the Metform plugin from n/a through 3.4.0. The Patchstack database entry gives the same range and says the fixed version is 3.4.1. The record is dated 2024-12-09, while Patchstack shows publication in late December 2023.
NVD scores it 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Patchstack gives the same score and rates it a low priority, saying it is unlikely to be exploited. It describes the issue as broken access control and the record adds that it allows exploiting incorrectly configured access control security levels.
The impact is limited to integrity, and the vector shows no confidentiality or availability effect. The sources do not say which action lacks the check, so treat the issue as unauthenticated users being able to perform something that should be restricted.
How to check if you're exposed
Check the installed plugin version in the WordPress admin under Plugins, or from the command line if you have WP-CLI:
wp plugin list --name=metform
Anything at 3.4.0 or lower is affected. Do this on every site you manage, including staging copies, which are often forgotten and reachable from the internet.
Check for the premium add on too. Metform has a free core and extensions that depend on it, so confirm the core plugin version no matter what else is installed.
What to do now
- Update Metform to 3.4.1 or later on every WordPress site.
- Turn on automatic updates for the plugin if your change process allows it.
- Remove the plugin from sites that do not use it.
- Review form submissions and settings for unexpected changes.
- Scan your WordPress plugins regularly for other known issues.
Why it matters
The weakness is missing authorization, CWE-862. The code performs an action without checking whether the caller is allowed to do it. Unlike a broken login, there is nothing to bypass: the check is simply absent.
WordPress plugins are a frequent source of this flaw because actions are registered through hooks that can be called by anyone unless the developer adds a capability check. A plugin with many installs turns one missing check into a wide exposure.
The record shows no CISA Known Exploited Vulnerabilities listing. Patchstack calls it unlikely to be exploited, which is a prediction and not a report of attacks.
Quick check
Which version fixes CVE-2023-50903?
Metform 3.4.1, according to the Patchstack entry. Versions up to 3.4.0 are affected.
Why a low priority rating?
Patchstack rated it low priority and unlikely to be exploited because the impact is limited, but patching is quick and worth doing.
Sources
Last reviewed: 19 October 2026.
