Input validation vulnerability in WP Firebase Push Notification 1.2.0

The WP Firebase Push Notification plugin for WordPress has a security issue that can be exploited by hackers. This issue is present in all versions up to and including 1.2.0. The problem is that the plugin does not properly check for a security code, known as a nonce, when using the wfpn_broadcast_notification_message() function. This means that attackers who are not logged in can send out fake notifications if they can convince the website’s administrator to click on a malicious link.