The Contact Form 7 – Dynamic Text Extension plugin for WordPress contains an information disclosure vulnerability (CWE-200) identified as CVE-2024-10084. Authenticated attackers with Contributor-level privileges or higher can exploit the CF7_get_post_var shortcode to retrieve titles and contents of private and password-protected posts that belong to other users. This vulnerability affects all versions up to and including 4.5. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, and limited confidentiality impact without integrity or availability effects. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with Contributor-level or higher access can extract sensitive information from private and password-protected posts they do not own, potentially exposing confidential content. The vulnerability does not affect data integrity or system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious shortcode usage. Avoid using the vulnerable shortcode CF7_get_post_var in untrusted contexts.