Input validation vulnerability in Nested Pages 3.2.7

The Nested Pages plugin for WordPress has a security vulnerability in all versions up to 3.2.7. This is because it does not properly check for a specific code to ensure the legitimacy of a request to the ‘settingsPage’ function, and it also does not clean up the ‘tab’ parameter. This means that someone who is not logged in to the site can manipulate the system and potentially access local PHP files by tricking the site administrator into clicking on a link.