Input validation vulnerability in Big Store 1.9.3

The Big Store plugin for WordPress is not secure in versions up to and including 1.9.3. This means that an attacker who is not authorized to do so can activate any plugin on a website if they can get a site administrator to click a link. The reason this is possible is because the plugin is missing or not properly using a type of security feature known as a nonce validation on the default_home and th_activeplugin functions.