Input validation vulnerability in Custom Post Status 1.1.0

The Custom Post Status plugin for WordPress, up to version 1.1.0, has a security vulnerability called Cross-Site Request Forgery. This is because it does not properly check for a specific code (called a nonce) when performing a certain function. This means that someone without permission can trick a site administrator into doing something they shouldn’t, like clicking on a link.