CVE-2023-6630

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Exposure of Private Personal Information to an Unauthorized Actor pada rocklobster contact form 7. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.

Rincian

Terbit di NVD

11 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3019572%40contact-form-7-dyna... patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=cve product · advisory pihak ketiga