Input validation vulnerability in Church Admin 4.1.32

The Church Admin plugin for WordPress has a security issue that makes it vulnerable to an attack called Cross-Site Request Forgery. This problem affects all versions of the plugin up to 4.1.32. The issue is caused by a mistake in the way the plugin checks for a special code called a “nonce” which helps to prevent unauthorized actions. Because of this mistake, attackers who are not logged into the website can trick the website’s administrator into doing something they shouldn’t, like clicking on a harmful link.