Buy Me a Coffee – Button and Widget Plugin < 3.8 - Cross-Site Request Forgery

Description

The plugin does not properly validate nonces in several functions, including recieve_post, bmc_disconnect, name_post, and widget_post. This lack of validation can lead to Cross-Site Request Forgery, allowing unauthenticated individuals to modify the plugin's settings by deceiving the site's administrator into interacting with a malicious link.