CVE-2023-6630
Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference
mediumExposure of Private Personal Information to an Unauthorized Actor
4.3
CVSS Score
4.3
CVSS Score
medium
Severity
4.2.0
Patched in
202d
Time to patch
Description
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NAttack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Low
Confidentiality
None
Integrity
None
Availability
Technical Details
Affected versions
<=4.1.0PublishedJanuary 10, 2024
Last updatedJuly 29, 2024
Affected plugincontact-form-7-dynamic-text-extension
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.