PT-2024-16017 · WordPress · Contact Form 7 – Dynamic Text Extension

Francesco Carlucci · Published 2024-11-05 · Updated 2024-11-07 · CVE-2024-10084

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Contact Form 7 – Dynamic Text Extension plugin for WordPress versions prior to 4.5.0

Description The Contact Form 7 – Dynamic Text Extension plugin for WordPress has a Basic Information Disclosure issue. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract the titles and text contents of private and password-protected posts they do not own. The issue is related to the CF7 get post var shortcode.

Recommendations Update to version 4.5.0 or later to secure your site. As a temporary workaround, consider restricting access to the CF7 get post var shortcode until the update is applied. Ensure you update to the latest version to mitigate risks.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-10084

Affected Products

Contact Form 7 – Dynamic Text Extension

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-10084 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10084 · Vendor Advisory
• https://twitter.com/CVEnew/status/1853943221594050643 · Twitter Post
• https://twitter.com/transilienceai/status/1854386712694431910 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1854104446105522211 · Twitter Post
• https://twitter.com/transilienceai/status/1854386726242038204 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e051a83e-ad5a-4789-bfee-e03aa9d6a3fc?source=cve · Note
• https://t.me/cvedetector/9956 · Telegram Post
• https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/tags/4.5.0/includes/shortcodes.php#L225 · Note