WordPress Uninstall <= 1.2.1 - WordPress Deletion via CSRF

The plugin does not have any CSRF check in place, allowing attackers to make a logged in admin delete the entire WordPress installation

v1.2 attempted to fix the issue by adding an authorisation check to ensure that the user executing the request is an admin, which does not fix anything CSRF related.

https://example.com/wp-admin/admin-ajax.php?action=uninstall