Input validation vulnerability in Availability Calendar 1.2.6

The Availability Calendar plugin for WordPress is vulnerable to attack if you are using versions 1.2.6 or earlier. This means that someone with malicious intent, who can get a site administrator to click on a link, can create an availability window. This is because the plugin is missing or not correctly using a security feature called a nonce validation on the add_availability_calendar_create_admin_page() function.