The myStickymenu WordPress plugin prior to 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
premio mystickymenu