Input validation vulnerability in Jetpack VaultPress 1.8.6

The VaultPress plugin for WordPress has a security flaw that lets attackers run code on the server. This can be done by unauthenticated attackers, meaning anyone can do it. To make it work, attackers need to get a special key from the VaultPress website. However, the plugin does not require a secure connection (like SSL) to get this key, which allows the key to be seen by an attacker who is looking at the traffic.