CVE-2023-6630: Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7getcustomfield and CF7getcurrentuser shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6630?
CVE-2023-6630 has been classified as a medium severity vulnerability.
How do I fix CVE-2023-6630?
To fix CVE-2023-6630, update the Contact Form 7 – Dynamic Text Extension plugin to version 4.1.1 or later.
What versions of the plugin are affected by CVE-2023-6630?
CVE-2023-6630 affects all versions of the Contact Form 7 – Dynamic Text Extension plugin up to and including 4.1.0.
What type of vulnerability is CVE-2023-6630?
CVE-2023-6630 is classified as an Insecure Direct Object Reference vulnerability.
Can CVE-2023-6630 be exploited by users?
Yes, CVE-2023-6630 can be exploited by users due to missing validation on user-controlled keys.