Easy Google Analytics for WordPress <= 1.6.0 - Cross-Site Request Forgery

The Easy Google Analytics for WordPress plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation in the 'ga_admin_set.php' file. This makes it possible for unauthenticated attackers to update the plugin's Google Analytics account and client ID options to arbitrary values including a stored Cross-Site Scripting payload granted they can trick a site administrator into performing an action such as clicking on a link. Additionally the 'ga_admin_set.php' can be accessed directly, and though it is not possible to update options by doing so, loading it via a separate LFI vulnerability would allow an attacker to update options as well.