CVE-2024-10084

CVE-2024-10084 describes a basic information disclosure vulnerability in all versions of the Contact Form 7 – Dynamic Text Extension WordPress plugin up to and including 4.5. This flaw allows authenticated attackers with Contributor-level access or higher to extract titles and text content from private or password-protected posts they do not own, via the CF7_get_post_var shortcode. Rated 4.3 MEDIUM on CVSS, the vulnerability has a low attack complexity and requires local user privileges, with a potential impact of low confidentiality. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.