Input validation vulnerability in Simple Local Avatars 2.7.10

The Simple Local Avatars plugin for WordPress has a security issue called Cross-Site Request Forgery. This can happen in versions 2.7.10 and below. It is caused by a problem with checking for a security code when using the save_default_avatar_file_id() function. This means that people who are not logged in can make a request that looks real and change the default avatar file. They can do this by tricking a site administrator into clicking on a link.