Input validation vulnerability in Instantio – WooCommerce Quick Checkout | Instant Checkout, Side Cart & Popup Cart 1.2.5

The Instantio – WooCommerce Quick Checkout | Instant Checkout, Side Cart & Popup Cart plugin for WordPress is vulnerable to a security flaw called Cross-Site Request Forgery. This affects versions up to, and including, 1.2.5. The vulnerability is due to a missing or incorrect nonce validation on the instantio_lite_ajax_quickview_variable_products function. This means that unauthenticated attackers can add products to a cart without the site user’s knowledge. They can do this by getting the user to click on a specially-made link.