Redirection for Contact Form 7 2.6.0 - 3.2.15 - Unauthenticated Forged Personal Data Request Creation

Description

The plugin does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.