Show-Hide / Collapse-Expand <= 1.2.6 - Missing Authorization

The Show-Hide / Collapse-Expand plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the bg_show_hide_save_plugin_settings() function called via and admin_post hook in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers with minimal permissions such as a subscriber to modify the plugin's settings. This can also be exploited via CSRF due to missing nonce protection.