The Custom Post Type plugin for WordPress up to and including version 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the deletion functionality. This vulnerability allows an attacker to trick a site administrator into performing a deletion action via a forged request.