Input validation vulnerability in VikBooking Hotel Booking Engine & PMS 1.5.12

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is a piece of software that is susceptible to an attack known as Cross-Site Request Forgery. In versions prior to 1.5.12, this attack was made possible because of a lack of validation for something called a nonce on the exec_multitask_widgets function. This means that if an attacker could convince a site administrator to click on a link or take some other action, they could send a forged request that would then be accepted.