Input validation vulnerability in WP Custom Post Template 1.0

The WP Custom Post Template plugin for WordPress is vulnerable to malicious attacks in versions up to and including 1.0. An unauthenticated attacker can make changes to the plugin’s settings without permission by tricking an administrator into clicking on a link. This is possible because the plugin is missing an important security feature called nonce validation on the wp_post_template_setting() function.