The Top 10 plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery. This affects versions up to and including 2.10.4. This means that if someone can get a site administrator to click a link, they can use this vulnerability to get access to the top 10 table without having to be authenticated. This happens because the plugin does not have the right kind of protection (called nonce validation) on the tptn_export_tables() function.