Input validation vulnerability in DirectoryPress Frontend 2.7.9

A plugin called DirectoryPress Frontend, used with WordPress, is at risk of a security issue called Cross-Site Request Forgery. This vulnerability affects all versions up to and including 2.7.9. The problem lies in the dpfl_listingStatusChange() function, which does not properly check for a security code called a “nonce.” As a result, someone who is not authorized could potentially change the status of a listing by sending a fake request, as long as they can trick the website administrator into doing something, like clicking on a link.