Advanced Local Pickup for WooCommerce <= 1.5.2 - Cross-Site Request Forgery

The Advanced Local Pickup for WooCommerce for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the functions wclp_update_state_dropdown_fun, wclp_update_work_hours_list_fun, wclp_update_edit_location_form_fun, and wclp_apply_work_hours_fun. This makes it possible for unauthenticated attackers to invoke those functions resulting in plugin settings changes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.