Insecure Direct Object Reference in Contact Form 7 Dynamic Text Extension for WordPress

CVE-2023-6630

What is CVE-2023-6630?

A security flaw exists in the Contact Form 7 – Dynamic Text Extension plugin for WordPress, affecting all versions up to and including 4.1.0. The vulnerability arises from inadequate validation of a user-controlled key utilized in CF7_get_custom_field and CF7_get_current_user shortcodes. This loophole permits authenticated attackers with contributor access or higher to potentially access sensitive metadata from arbitrary post types by referring to the post via its ID and the metadata using its key. Immediate action is advised to mitigate this risk to safeguard user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References