Input validation vulnerability in Floating Action Button 1.2.1

The Floating Action Button plugin for WordPress has a security flaw in all versions up to 1.2.1. This flaw makes it possible for unauthenticated attackers to change the plugin’s settings without authorization, if they can get a website administrator to click on a malicious link. This happens because the plugin does not validate nonce (a security measure) correctly on the wp_ajax_fz_fab_settings_save function.