Input validation vulnerability in Visitor Traffic Real Time Statistics 2.13

The Visitor Traffic Real Time Statistics Plugin for WordPress is susceptible to a security issue. Versions up to and including 2.13 have a problem where attackers can install and activate plugins without any authentication. This can be done by tricking a site administrator into taking some kind of action, such as clicking on a link. This is possible because the plugin does not have a proper security check called a nonce validation on its ‘cp_plugins_do_button_job_later_callback’ AJAX action.