Input validation vulnerability in HT Mega – Absolute Addons For Elementor 2.3.3

The HT Mega plugin for WordPress is not secure in versions up to 2.3.3. A vulnerability in this plugin, known as Cross-Site Request Forgery, can allow unauthenticated attackers to install and activate plugins without permission. This is because the security measure known as nonce validation is either not included or not working correctly in the /admin/include/template-library.php file. An unauthenticated attacker could potentially trick a website administrator into clicking a malicious link and thus gain access to the site.