Insecure Direct Object Reference in Contact Form 7 Dynamic Text Extension for WordPress

CVE-2023-6630

Summary

A security flaw exists in the Contact Form 7 – Dynamic Text Extension plugin for WordPress, affecting all versions up to and including 4.1.0. The vulnerability arises from inadequate validation of a user-controlled key utilized in CF7_get_custom_field and CF7_get_current_user shortcodes. This loophole permits authenticated attackers with contributor access or higher to potentially access sensitive metadata from arbitrary post types by referring to the post via its ID and the metadata using its key. Immediate action is advised to mitigate this risk to safeguard user data.

References