Input validation vulnerability in Parcel Pro 1.6.11

The Parcel Pro plugin for WordPress is vulnerable to something called Cross-Site Request Forgery in all versions up to version 1.6.11. This means that an unauthenticated attacker can make changes to orders and shipments if they can get a site administrator to do something like click on a link. This is because the action_handler function does not have the right kind of security measure (called a “nonce”) in place to protect it.