CVE-2023-5134

Name of the Vulnerable Software and Affected Versions Easy Registration Forms for WordPress versions up to, and including, 2.1.1

Description The issue allows authenticated attackers with subscriber-level capabilities or above to retrieve arbitrary sensitive user meta via the erforms user meta shortcode due to insufficient controls on the information retrievable. This enables the disclosure of sensitive information.

Recommendations For versions up to, and including, 2.1.1, consider disabling the erforms user meta shortcode until a patch is available to prevent information disclosure. Restrict access to sensitive user meta to minimize the risk of exploitation.