CVE-2021-24282

The Redirection for Contact Form 7 plugin before version 2.3.4 contained multiple AJAX endpoints that lacked proper authorization checks, allowing any logged-in user regardless of their role to perform administrative functions. An attacker with subscriber-level access could exploit these endpoints to reset plugin configurations, add arbitrary actions to contact forms, and execute other sensitive operations intended only for administrators.

Based on public CVE data (MITRE/NVD).