Sensitive data exposure via unauthenticated CSV export

Sensitive data exposure in Track Geolocation Of Users Using Contact Form 7 allows remote attackers to read submission data via export requests. In 3.0.2 and earlier, the action__cfgeo_init_99 handler runs on the global init hook and streams a CSV whenever export_csv and post_type=cfgeozw_data are supplied, but it performs no nonce, authentication, or capability check before querying stored _form_data and writing each field to the response. Any internet-reachable WordPress site running the plugin is exposed if that request path is reachable, and the disclosure can include geolocation metadata and Contact Form 7 submission contents rather than only summary records.