Input validation vulnerability in Spoiler Block 1.7

The Spoiler Block plugin for WordPress has a security issue called Cross-Site Request Forgery. This can happen in any version up to 1.7. The problem is that the plugin does not properly check for a special code called a “nonce”. Because of this, someone who is not logged in can make changes to the plugin’s settings and add harmful code to the website. They can do this by tricking the person in charge of the website into clicking on a link.