The Contact Form and Calls To Action by vcita plugin for WordPress suffers from a missing capability check in the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions in versions up to 2.7.1. This lack of authorization allows authenticated users with subscriber-level privileges or higher to toggle widgets on or off, constituting an unauthorized modification of data. The vulnerability is tracked as CWE-862 (Missing Authorization). The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and resulting in integrity impact only.

An attacker with subscriber-level access or above can modify the enabled state of widgets in the plugin without proper authorization. This could lead to unauthorized changes in the website's user interface or functionality controlled by these widgets. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit subscriber-level access to trusted users only. Monitor for updates from vcita regarding a security patch addressing this missing authorization vulnerability.