Counter Box < 1.2.1 - Arbitrary Counter Activation/Deactivation via CSRF

The plugin is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks

https://example.com/wp-admin/admin.php?page=counter-box&id=1&action=activate
https://example.com/wp-admin/admin.php?page=counter-box&id=1&action=deactivate