CVE-2023-6630
Last modified
CVE-2023-6630 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rocklobster | Contact Form 7 | <= 4.1.0 |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=cveProduct, Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=cveProduct, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6630?
How severe is CVE-2023-6630?
How do I fix CVE-2023-6630?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6623The Essential Blocks WordPress plugin before 4.4.3 does not …9.8
- CVE-2023-6624The Import and export users and customers plugin for WordPre…5.4
- CVE-2023-6625The Product Enquiry for WooCommerce WordPress plugin before …4.3
- CVE-2023-6626The Product Enquiry for WooCommerce WordPress plugin before …4.8
- CVE-2023-6627The WP Go Maps (formerly WP Google Maps) WordPress plugin be…6.1
- CVE-2023-6629The POST SMTP Mailer – Email log, Delivery Failure Notificat…6.1
- CVE-2023-6631PowerSYSTEM Center versions 2020 Update 16 and prior contain…7.8
- CVE-2023-6632The Happy Addons for Elementor plugin for WordPress is vulne…6.1
- CVE-2023-6633The Site Notes WordPress plugin through 2.0.0 does not have …4.3
- CVE-2023-6634The LearnPress plugin for WordPress is vulnerable to Command…9.8
- CVE-2023-6635The EditorsKit plugin for WordPress is vulnerable to arbitra…7.2
- CVE-2023-6636The Greenshift – animation and page builder blocks plugin fo…7.2
Are you affected by CVE-2023-6630?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST