Input validation vulnerability in Woo Custom and Sequential Order Number 2.6.0

The Woo Custom and Sequential Order Number plugin for WordPress has a security vulnerability in versions up to, and including, 2.6.0. An attacker can take advantage of this vulnerability by sending a maliciously crafted link to a site administrator. If the administrator clicks on the link, the attacker can modify the plugin’s settings, even though the attacker is not authenticated. This is due to a lack of verification (called a nonce) in the wcson_save_settings() function.