The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution on all versions up to and including 5.0.6. This flaw arises because the plugin runs do_shortcode on a user-controlled value that has not been properly validated, allowing an attacker to inject and execute any shortcode. The impact is the ability to run arbitrary code within the context of the plugin, potentially enabling other malicious actions. The vulnerability was partially patched in version 5.0.4 but remains in 5.0.6 and later fixed releases.

All WordPress sites that include the sevenspark Contact Form 7 – Dynamic Text Extension plugin with a version number of 5.0.6 or earlier are affected. No other products are listed.

The CVSS score of 6.5 places this flaw in the medium severity range. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. It is not listed in CISA’s KEV catalog. Attackers can trigger this flaw by sending unauthenticated HTTP requests that cause the plugin to invoke do_shortcode. The likely attack vector is network-based since the plugin processes user input from the web.