diff --git a/wp-libre-form.php b/wp-libre-form.php
index 3e10299..f2c7b96 100644
--- a/wp-libre-form.php
+++ b/wp-libre-form.php
@@ -96,6 +96,7 @@ public static function load_our_textdomain() {
   public function register_rest_routes() {
     register_rest_route( 'wplf/v1', 'submit', [
       'methods' => 'POST',
+      'permission_callback' => '__return_true',
       'callback' => 'wplf_ajax_submit_handler', // admin-ajax handler, works but...
       // The REST API handbook discourages from using $_POST, and instead use $request->get_params()
     ]);