Input validation vulnerability in wp-mpdf 3.5.1

The wp-mpdf plugin for WordPress is vulnerable to a type of attack known as Cross-Site Request Forgery (or CSRF). This is present in versions up to, and including, 3.5.1. It is caused by a lack of adequate security measures on the mpdf_admin_savepost() function. This means that an unauthenticated attacker can send a malicious request and potentially trick a site administrator into performing an action, such as clicking a link.