Maspik – Spam blacklist <= 0.7.8 - Cross-Site Request Forgery

The Maspik plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.7.8. This is due to missing or incorrect nonce validation in the file /admin/partials/contact-forms-anti-spam-log.php. This makes it possible for unauthenticated attackers to clear plugin logs and stat counter via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.