Hybrid Composer <= 1.4.6 - Unauthenticated Options Update

Description

This plugin has a function to update Wordpress options via Ajax and it's set with the following:
add_action('wp_ajax_nopriv_hc_ajax_save_option', 'hc_ajax_save_option');

Which means it does not require authentication and is exploitable by anyone on the internet.

I've already spoken to the plugin author about this and he has patched the plugin and notified his users.

http://wordpress.framework-y.com/hybrid-composer/