CVE-2024-4319 describes a missing authorization vulnerability in the Advanced Contact form 7 DB WordPress plugin by vsourz1td. Specifically, the 'vsz_cf7_export_to_excel' function lacks a capability check, enabling unauthenticated users to export and download form submission data. This issue affects all versions up to and including 2.0.2. The vulnerability is network exploitable without authentication and results in limited confidentiality impact (disclosure of form data). No integrity or availability impacts are noted.

An attacker can access and download submitted form entry data without authentication, leading to unauthorized disclosure of potentially sensitive information collected via the plugin's forms. There is no indication of data modification or service disruption. The impact is limited to confidentiality loss of form submissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's export functionality by limiting public access to the affected WordPress site or disabling the export feature if possible. Monitor official vendor channels for updates or patches addressing this authorization issue.