Input validation vulnerability in MyCurator Content Curation 3.74

The MyCurator Content Curation plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery. This affects all versions of the plugin up to version 3.74. The plugin is missing or incorrect security measures, called nonce validation, on the mct_ai_logspage() function. This means that an attacker does not need to be authenticated, or signed in, to the website in order to carry out this attack. This could be done by getting a site administrator to click a link, for example. The attacker can then filter and reset logs without the administrator’s permission.