The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to a security issue called Cross-Site Request Forgery. This means that people who do not have permission to access the plugin can make changes to it if they can trick a user of the website into clicking on a link. This vulnerability affects versions up to 3.7.0 and allows unauthorised users to change the plugin’s settings, modify bulletins, create new bulletins, and more.