Input validation vulnerability in Zephyr Project Manager 3.3.93

The Zephyr Project Manager plugin for WordPress is vulnerable to an attack called Cross-Site Request Forgery. This means that in versions up to 3.3.93, a malicious person may be able to delete all plugin data without needing to log in. This is because the security measure known as “nonce validation” is not present or is incorrect in the ~/templates/settings.php file. For an attack to be successful, a website administrator must be tricked into performing an action, such as clicking on a link.