CVE-2023-6630
First published: Thu Jan 11 2024(Updated: )
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rocklobster Contact Form 7 | <=4.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3019572%40contact-form-7-dynamic-text-extension%2Ftrunk&old=2968460%40contact-form-7-dynamic-text-extension%2Ftrunk&sfp_email=&sfph_mail=#file4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=cve
Frequently Asked Questions
What is the severity of CVE-2023-6630?
CVE-2023-6630 has been classified as a medium severity vulnerability.
How do I fix CVE-2023-6630?
To fix CVE-2023-6630, update the Contact Form 7 – Dynamic Text Extension plugin to version 4.1.1 or later.
What versions of the plugin are affected by CVE-2023-6630?
CVE-2023-6630 affects all versions of the Contact Form 7 – Dynamic Text Extension plugin up to and including 4.1.0.
What type of vulnerability is CVE-2023-6630?
CVE-2023-6630 is classified as an Insecure Direct Object Reference vulnerability.
Can CVE-2023-6630 be exploited by users?
Yes, CVE-2023-6630 can be exploited by users due to missing validation on user-controlled keys.
- agent/references
- agent/type
- agent/description
- agent/author
- agent/remedy
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/rocklobster
- canonical/rocklobster contact form 7
- version/rocklobster contact form 7/4.1.0