Input validation vulnerability in HT Builder – WordPress Theme Builder for Elementor 1.2.9

The HT Builder plugin for WordPress is vulnerable to a type of cyberattack known as Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is because it doesn’t use a form of protection called nonce validation on the plugin_activation() function. This allows unauthenticated attackers to activate any plugin if they can get a site administrator to do something like click a link.