CVE-2024-13717

Vulnerability

The Contact Form and Calls To Action by vcita plugin for WordPress versions up to and including 2.7.1 fails to perform proper capability checks on the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact AJAX functions. This missing authorization allows any authenticated user, including those with only subscriber-level access, to enable or disable widgets managed by the plugin [1]. The plugin has been closed and removed from the WordPress.org plugin directory as of January 30, 2025 due to a security issue [1].

Exploitation

An attacker needs only a valid WordPress account with subscriber-level privileges or above. No additional permissions or complex conditions are required. By sending crafted AJAX requests to the vulnerable functions, the attacker can toggle the plugin’s widgets on or off without proper authorization checks [1].

Impact

Successful exploitation results in unauthorized modification of widget state — the attacker can enable or disable the plugin's contact form and calls to action widgets. This impacts the integrity of site content and layout, potentially disrupting intended functionality or hiding important elements from visitors. The attacker does not gain elevated privileges or access to sensitive data, but alters the site's appearance and behavior [1].

Mitigation

The plugin has been closed and removed from the official WordPress.org plugin directory as of January 30, 2025, citing a security issue; no patched version was released [1]. Users who have this plugin installed are strongly advised to uninstall it immediately and replace it with an alternative. No workaround is available as the plugin is no longer maintained or distributed [1].