Input validation vulnerability in WOLF – WordPress Posts Bulk Editor and Manager Professional 1.0.6

The WOLF plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery. This type of attack can occur in versions up to and including 1.0.6. This vulnerability happens because the plugin is missing or incorrectly validating a special code called a ‘nonce’ when a certain function called ‘wpbe_update_page_field’ is used. This makes it possible for unauthenticated attackers to use the function and change settings on a website if they can get a website administrator to do something like click a link.