Input validation vulnerability in wp tell a friend popup form 7.1

The WordPress Tell a Friend Popup Form Plugin, up to version 7.1, is vulnerable to Cross-Site Request Forgery. This means that unauthenticated attackers can change the settings of the plugin by sending a special kind of request, so long as they can get a site administrator to do something like click on a link. The vulnerability is caused by the ‘TellAFriend_admin’ function, which lacks proper nonce validation.