WooRockets Nitro <= 1.7.9 - Unauthenticated Arbitrary Plugin Installation

Description

The theme does not have authorisation in some of its AJAX actions, and relied on CSRF checks for it. As one of the action allowed for nonces to be disclosed under a specific circumstance, unauthenticated users could then use them to install and active arbitrary plugins (via a zip file), as well as set the blog as a demo, erasing existing data