CVE-2021-24281

The Redirection for Contact Form 7 plugin prior to version 2.3.4 contained a vulnerability that allowed users with any authentication level, including those with subscriber access, to remove arbitrary posts from a website through the delete_action_post AJAX function. This flaw could be exploited to delete posts without proper authorization checks.

Based on public CVE data (MITRE/NVD).