Input validation vulnerability in Kopa Framework 1.3.5

The Kopa Framework plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to and including 1.3.5. This vulnerability happens because the plugin does not properly validate a security code called a nonce when it runs one of its functions. This makes it possible for an unauthenticated attacker to invoke this function if they can trick a website administrator into clicking on a link.