Input validation vulnerability in Hack me if you can 1.2

The Hack me if you can plugin for WordPress has a security vulnerability called Cross-Site Request Forgery. This problem affects all versions up to and including 1.2. The issue is caused by a function that doesn’t properly check for a special code called a nonce. This allows hackers who are not logged in to change the plugin’s settings and add harmful code to a website if they can trick the site’s administrator into clicking on a fake link.