Input validation vulnerability in Thumbnail For Excerpts 2.1

The Thumbnail For Excerpts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 2.1. A Cross-Site Request Forgery attack is when an attacker tricks a website administrator into performing an action such as clicking on a link, without them knowing. In this case, the plugin is missing a validation called a “nonce” which means an attacker could access and modify the plugin’s settings, as well as update options, without the website administrator’s knowledge.