The vulnerability CVE-2024-1778 affects the Admin side data storage for the Contact Form 7 WordPress plugin by zestardtechnologies. It is caused by a missing capability check in the zt_dcfcf_change_bookmark() function, which permits unauthenticated users to alter bookmark statuses. This issue is present in all versions up to and including 1.1.1. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or official remediation guidance is currently available from the vendor.

An unauthenticated attacker can modify bookmark statuses in the affected plugin component, resulting in unauthorized integrity modification of data. There is no impact on confidentiality or availability. The vulnerability could potentially be used to alter administrative data related to Contact Form 7 bookmarks, but no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor plugin updates from zestardtechnologies and consider restricting access to the affected functionality where possible. No vendor advisory or patch links are currently available.