Input validation vulnerability in Typekit plugin for WordPress 1.2.3

The Typekit plugin for WordPress has a security issue called Cross-Site Request Forgery. This happens in all versions up to and including 1.2.3 because the plugin does not properly check for a security code called a nonce. This means that someone who is not logged in can make the website do something that it shouldn’t, as long as they can trick the person in charge of the website into clicking on a certain link.