CVE-2023-6630
published 2024-01-11CVE-2023-6630: The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.35%
26.8th percentile
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rocklobster | contact_form_7 | <= 4.1.0 | — |
| sevenspark | contact_form_7_dynamic_text_extension | <= 4.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Contact Form 7 Plugin up to 4.1.0 on WordPress resource injection
vuldb·2026-04-11·CVSS 4.3
CVE-2023-6630 [MEDIUM] Contact Form 7 Plugin up to 4.1.0 on WordPress resource injection
A vulnerability was found in Contact Form 7 Plugin up to 4.1.0 on WordPress and classified as critical. Impacted is an unknown function. Such manipulation leads to improper control of resource identifiers.
This vulnerability is referenced as CVE-2023-6630. It is possible to launch the attack remotely. No exploit is available.
GHSA
GHSA-c2vp-9842-2xq2: The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin
ghsa_unreviewed·2024-01-11
CVE-2023-6630 [MEDIUM] CWE-359 GHSA-c2vp-9842-2xq2: The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3019572%40contact-form-7-dynamic-text-extension%2Ftrunk&old=2968460%40contact-form-7-dynamic-text-extension%2Ftrunk&sfp_email=&sfph_mail=#file4https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=cvehttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3019572%40contact-form-7-dynamic-text-extension%2Ftrunk&old=2968460%40contact-form-7-dynamic-text-extension%2Ftrunk&sfp_email=&sfph_mail=#file4https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=cve
2024-01-11
Published