Input validation vulnerability in Marker.io – Visual Website Feedback 1.1.7

The Marker.io plugin for WordPress has a security vulnerability that could allow an unauthenticated attacker to manipulate the plugin’s settings and save destinations. This vulnerability affects all versions up to and including 1.1.6 and is caused by the lack of nonce validation on the markerio_save_destination() and markerio_save_option() functions. This means that if an attacker can trick a site administrator into performing an action such as clicking on a link, they could perform a Cross-Site Request Forgery.