Input validation vulnerability in Web Push Notifications – Webpushr 4.34.0

The Webpushr plugin for WordPress, up to and including version 4.34.0, has a security vulnerability. This means it is possible for unauthenticated attackers to perform local file inclusion attacks, if they can trick a site administrator into clicking on a link. This is because the plugin does not have the correct security measures in place, specifically, there is no nonce validation within the wpp_save_settings function.