Input validation vulnerability in Header Footer Code Manager 1.1.35

The Header Footer Code Manager plugin for WordPress has a security vulnerability in versions 1.1.34 and earlier. This vulnerability allows unauthenticated attackers to activate, deactivate, and delete existing snippets without permission. It happens because the plugin does not have the right kind of security check called a “nonce validation” on the “process_bulk_action function”. This means that an attacker can trick a site administrator into performing an action, such as clicking on a link, and the attacker can take control of the plugin.