Input validation vulnerability in Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions 2.12.7

A WordPress plugin called Paid Memberships Pro is at risk of a security issue called Cross-Site Request Forgery. This affects all versions up to 2.12.7. The problem is caused by a missing or incorrect security check on a function called pmpro_update_level_order(). This means that attackers who are not logged in can change the order of levels if they can trick a site administrator into clicking on a link.