Input validation vulnerability in Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free 3.4

The Funnelforms Free plugin for WordPress is vulnerable to an attack called Cross-Site Request Forgery. Versions up to and including 3.4 of this plugin are affected. This is because there is either no or incorrect nonce validation on the fnsf_copy_posts function. This means that an unauthenticated attacker could create copies of any post if they can get a site administrator to take an action, such as clicking a link.