Input validation vulnerability in WP Abstracts 2.7.2

The WP Abstracts plugin for WordPress has a security issue called Cross-Site Request Forgery. This means that versions up to 2.7.2 are at risk. The problem is that the plugin does not check for a specific code called a “nonce” on two functions: wpabstracts_load_status() and wpabstracts_delete_abstracts(). This allows attackers who are not logged in to the website to insert harmful code using a fake request, as long as they can trick the site administrator into doing something like clicking on a link.