What’s Vulnerable › Vulnerabilities

CVE-2024-10084: Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-05 · updated 2026-06-17
• Weakness: CWE-200

Description

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and including, 4.5 via the CF7_get_post_var shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract the titles and text contents of private and password-protected posts, they do not own.

Affected products

• sevenspark Contact Form 7 - Dynamic Text Extension: before 4.5.1 — fixed in 4.5.1

How to fix

Upgrade to a fixed version: sevenspark Contact Form 7 - Dynamic Text Extension 4.5.1. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/tags/4.5.0/includes/shortcodes.php#L225
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e051a83e-ad5a-4789-bfee-e03aa9d6a3fc?source=cve

Get alerted when CVE-2024-10084 or the next vulnerability affects your stack