Input validation vulnerability in WpStream – Live Streaming, Video on Demand, Pay Per View 4.5.4

The WpStream plugin is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to 4.5.4. This is because the plugin has either no protection or incorrect protection (called nonce validation) on a function called wpstream_update_local_event_settings. This makes it possible for an attacker to change settings on the site without needing to log in, if they can get a site administrator to do something like click on a link.