Input validation vulnerability in Request For Quote 1.3

The Request for Quote plugin for WordPress can be vulnerable to a type of attack called Cross-Site Request Forgery in versions before 1.3. This is because the plugin isn’t properly validating nonce values in the action_wpheka_add_to_quote and action_remove_item_from_rfq_list AJAX actions. This means that unauthenticated attackers can try to trick a site administrator into performing certain restricted administrative actions by sending them a special link.