Input validation vulnerability in Ultimate Before After Image Slider & Gallery – BEAF 4.5.4

The BEAF plugin for WordPress, up to and including version 4.5.4, has a security vulnerability called Cross-Site Request Forgery. This is because the bafg_new_feature_notice_dismissed() function does not properly check for a special code to verify the user’s identity. Because of this, attackers who are not logged in can trick a website administrator into taking an action, like clicking on a link, and then use that to dismiss important notices.