Contact Form and Calls to Action by vcita Missing Authorization Vulnerability on WordPress

A vulnerability exists in the Contact Form and Calls To Action by vcita plugin for WordPress, in all versions through 2.7.1. The issue arises from a lack of proper capability checks in the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions. This flaw allows authenticated attackers with subscriber-level access and above to unauthorizedly modify widget settings, enabling or disabling widgets at will.

Impact

Exploitation of this vulnerability allows for unauthorized modification of widget settings, specifically enabling or disabling widgets on the site.