This vulnerability in HT Plugins Extensions For CF7 versions up to 3.4.0 involves an authorization bypass caused by user-controlled keys that exploit improperly configured access control mechanisms. The issue allows attackers to circumvent intended authorization checks, potentially gaining unauthorized access to features or data. The CVSS score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is available at this time.

The vulnerability permits unauthorized users to bypass access controls in the affected plugin, potentially exposing limited confidential information. There is no reported impact on integrity or availability. Exploitation does not require privileges or user interaction, increasing the risk of remote exploitation. However, the confidentiality impact is limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in the plugin if possible. Monitor for updates from HT Plugins regarding patches or mitigations.