Input validation vulnerability in Table of Contents Plus 2302

The Table of Contents Plus plugin for WordPress (up to and including version 2302) is vulnerable to Cross-Site Request Forgery. This means that unauthenticated attackers can modify the plugin’s settings without authorization, if they can get a site administrator to do something like click on a link. The vulnerability is caused by incorrect nonce validation on the save_admin_options() function.