WordPress Contact Form Check Tester 1.0.2 XSS / Access Control

`# Exploit Title: WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control  
# Date: 2/28/2021  
# Author: 0xB9  
# Software Link: https://wordpress.org/plugins/contact-fo...ck-tester/  
# Version: 1.0.2  
# Tested on: Windows 10  
# CVE: CVE-2021-24247  
  
1. Description:  
The plugin settings are visible to all registered users in the dashboard.  
A registered user can leave a payload in the plugin settings.  
  
2. Proof of Concept:  
- Register an account  
- Navigate to the dashboard  
- Go to CF7 Check Tester -> Settings  
- Add a form  
- Add a field to the form  
- Put in a payload in either Field selector or Field value "><script>alert(1)</script>  
- Save  
Anyone who visits the settings page will execute the payload.  
  
`