Input validation vulnerability in wpCentral 1.5.7

The wpCentral plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery (CSRF). This affects versions of the plugin up to and including version 1.5.7. The plugin does not properly check for a special code called a ‘nonce’ which is used to verify that the request is legitimate. This leaves the plugin open to attack. If an unauthenticated attacker is able to get an administrator to click on a malicious link, it is possible for the attacker to update which IPs are allowed and reset the connection key.