Access violation vulnerability in Contact Form and Calls To Action by vcita 2.7.1

The plugin for WordPress called “Contact Form and Calls To Action by vcita” has a security issue that can allow someone to change data without permission. This is because the plugin does not check if the user has the right permissions before using the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions. This means that people who are logged in and have at least subscriber-level access can turn widgets on and off.