Atomic Edge analysis of CVE-2026-24991:
The Extensions For CF7 WordPress plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 3.4.0. The vulnerability exists in an AJAX endpoint that handles form data viewing. It allows authenticated users with Contributor-level permissions or higher to perform unauthorized actions due to a missing capability check.

Atomic Edge research identifies the root cause in the `htcf7ext_view_formdata_cb` function within the file `/extensions-for-cf7/includes/class-ajax-actions.php`. Before the patch, the function only verified the AJAX nonce via `check_ajax_referer`. The function did not validate if the current user possesses the required administrative capability to perform the action. This missing authorization check allowed lower-privileged users to pass the nonce verification and trigger the callback.

An attacker can exploit this vulnerability by sending a POST request to the WordPress `admin-ajax.php` endpoint. The request must include the action parameter set to `htcf7ext_view_formdata` and a valid nonce. The nonce is typically available to Contributor-level users within the plugin’s admin interface. The payload triggers the vulnerable callback function, allowing unauthorized access to form data or other actions handled by the function.

The patch adds a capability check before processing the request. The fix inserts a conditional statement that calls `current_user_can( ‘manage_options’ )`. If the check fails, the function sends a JSON error with a 403 status code. This change restricts the endpoint to users with administrator privileges only, aligning the authorization with the intended functionality. The version number was also updated from 3.4.0 to 3.4.1.

Successful exploitation could allow authenticated attackers with Contributor-level access to view or manipulate form submission data they are not authorized to access. This constitutes a data exposure issue. Depending on the full functionality of the `htcf7ext_view_formdata_cb` function, the impact could extend to unauthorized data deletion or modification, leading to a loss of data integrity.