Popup by Supsystic <= 1.10.19 - Cross-Site Request Forgery

The Popup by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.19. This is due to missing or incorrect nonce validation for a subset of actions on the 'havePermissions' function. This makes it possible for unauthenticated attackers to perform actions such as sending test emails or saving plugin options via a forged request granted they can trick an authorized user into performing an action such as clicking on a link.