The Top Friends WordPress plugin versions up to and including 0.3 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation in the top_friends_options_subpanel() function. This flaw allows unauthenticated attackers to modify plugin settings if they can trick an administrator into clicking a crafted link.