Input validation vulnerability in WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds 4.3

The AWP Classifieds plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to, and including, 4.3. This means that there is missing security validation on several functions such as dispatch(), try_to_delete_categories(), try_to_update_category(), try_to_move_categories(), and more. This makes it possible for a malicious person to manage categories on a website without being logged in, as long as they can get someone with administrative privileges to click on a link or perform an action.