The post-pay-counter plugin prior to 2.731 for WordPress has no permissions check for an update-settinga action.
post pay counter project post pay counter