CVE-2024-10084

Name of the Vulnerable Software and Affected Versions Contact Form 7 – Dynamic Text Extension plugin for WordPress versions prior to 4.5.0

Description The Contact Form 7 – Dynamic Text Extension plugin for WordPress has a Basic Information Disclosure issue. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract the titles and text contents of private and password-protected posts they do not own. The issue is related to the CF7 get post var shortcode.

Recommendations Update to version 4.5.0 or later to secure your site. As a temporary workaround, consider restricting access to the CF7 get post var shortcode until the update is applied. Ensure you update to the latest version to mitigate risks.