LEAV Last Email Address Validator WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the LEAV Last Email Address Validator plugin for WordPress, affecting versions through 1.7.1. The vulnerability arises from inadequate nonce validation in the 'display_settings_page' function, allowing unauthenticated attackers to alter plugin settings by sending a forged request, provided they can deceive a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin settings by an attacker, potentially leading to incorrect email validation and increased spam.