The Visit Counter WordPress plugin version 1.0 has a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation on the widgets.php page. This flaw allows unauthenticated attackers to trick site administrators into performing actions that update plugin settings and potentially inject malicious scripts.