Input validation vulnerability in LWS SMS 2.4.1

The LWS SMS plugin for WordPress has a security issue called Cross-Site Request Forgery. This affects all versions up to 2.4.1. The problem is that a certain function doesn’t properly check for a security code, making it possible for unauthorized people to change settings and add harmful code to a website. This can happen if the attacker can trick the site administrator into doing something, like clicking on a link.