Legal Pages < 1.3.9 - Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data

Description

The Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the moveToTrash and fetch_and_insert_template_data functions. This makes it possible for unauthenticated attackers to trash posts and insert template data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.