CVE-2026-24991: 
WordPress vulnerability analysis and mitigation

CVE-2026-24991 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the HT Plugins Extensions For CF7 WordPress plugin. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels to access restricted data. The vulnerability affects all versions of the plugin up to and including 3.4.0. It was published on February 3, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The plugin fails to properly validate whether a requesting user is authorized to access a specific object when a user-controlled key (such as a record ID or form submission identifier) is supplied in a request. Because no authentication or ownership check is enforced server-side, an unauthenticated attacker can manipulate the key value in a network request to access data belonging to other users or restricted resources. No special privileges or user interaction are required for exploitation (Feedly, Patchstack).

Successful exploitation results in unauthorized read access to sensitive information managed by the Extensions For CF7 plugin, such as Contact Form 7 submission data, which may include personally identifiable information (PII) submitted by site visitors. The confidentiality impact is rated Low, with no direct integrity or availability impact. However, exposure of form submission data could facilitate further attacks such as phishing or credential stuffing if sensitive user data is disclosed (Feedly).

The vulnerability is exploitable remotely with no authentication, no user interaction, and low attack complexity, making it trivially accessible to unauthenticated attackers. The EPSS score is approximately 0.037%, indicating a currently low probability of active exploitation in the wild. There is no evidence of in-the-wild exploitation, no known public PoC exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Feedly).

1. Reconnaissance: Identify WordPress sites running the Extensions For CF7 plugin (version ≤ 3.4.0) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/extensions-for-cf7/).
2. Identify target endpoint: Locate the plugin's AJAX or REST API endpoint that handles CF7 form submission retrieval, typically accessible without authentication.
3. Enumerate object keys: Send requests with incrementally varied object identifiers (e.g., submission IDs or entry IDs) as user-controlled parameters in the HTTP request.
4. Bypass authorization: Because the plugin does not validate ownership or authorization server-side, responses will return data associated with the supplied key regardless of the requester's identity.
5. Exfiltrate data: Collect returned form submission data, which may include names, email addresses, phone numbers, or other PII submitted via Contact Form 7 forms on the target site (Feedly, Patchstack).

• Network: Repeated unauthenticated HTTP GET or POST requests to plugin-specific AJAX endpoints (e.g., wp-admin/admin-ajax.php with plugin-specific action parameters) with sequentially or randomly varying numeric ID parameters from a single or small set of IP addresses.
• Logs: WordPress access logs showing high-frequency requests to plugin endpoints without session cookies or authentication tokens; HTTP 200 responses to unauthenticated requests that would normally require authorization.
• Process/Application: Unusual spikes in CF7-related database queries for form entries from non-administrative sources visible in query logs.

Users should update the Extensions For CF7 plugin to a version higher than 3.4.0, which addresses the IDOR vulnerability by implementing proper server-side authorization checks. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to its endpoints via a Web Application Firewall (WAF) rule. Site administrators should also audit CF7 form submission data for any signs of unauthorized access (Patchstack).