WP-Chatbot for Messenger <= 4.7 - Missing Authorization

The WP-Chatbot for Messenger plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions like csv(), cancel_subscribe(), create_subscribe(), notice_lead_off(), banner_off() and many more called via AJAX actions in versions up to, and including, 4.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings, manipulate subscription settings, and export submitted form data.