CVE-2023-6630 MEDIUM

CVE-2023-6630: Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference

Vendor Sevenspark
Product Contact Form 7 – Dynamic Text Extension
Weakness CWE-359
Published January 11, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.

Key dates

02Disclosure timeline

January 11, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-37533 IBM InfoSphere Information Server information disclosure CVE-2024-13216 HT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor CVE-2025-66172 Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to CVE-2024-42347 URL preview setting for a room is controllable by the homeserver in matrix-react-sdk CVE-2023-48680