Input validation vulnerability in Add Local Avatar 12.1

The Add Local Avatar plugin for WordPress is vulnerable to an attack called Cross-Site Request Forgery. This vulnerability affects versions of the plugin up to and including version 12.1. The problem is that the plugin doesn’t have a strong enough security measure called “nonce validation” on the manage_avatar_cache function. This means that if an attacker can get a website administrator to click on a malicious link, they can gain access to the website’s avatars without being authenticated.