The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This due missing or incorrect nonce validation on the 'restrict-file-access' page. makes it possible unauthenticated attackers delete arbitrary files server, which can easily lead remote code execution when right file deleted (such as wp-config.php), via a forged request granted they trick site administrator into performing an action such clicking link.