Input validation vulnerability in Word Balloon 4.20.2

The Word Balloon plugin for WordPress is vulnerable to an attack called Cross-Site Request Forgery. This type of attack can be done in any version of the plugin up to the latest version 4.20.2. The issue is due to a missing or incorrect security feature called a nonce on the ‘delete’ action. This means that an attacker who can get a website administrator to click on a malicious link can delete any avatar they want from the website.