The Top Bar Notification plugin for WordPress versions up to and including 1.12 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in the tbn_ajax_add() function. This vulnerability allows unauthenticated attackers to trick site administrators into performing actions that update plugin settings and potentially inject malicious scripts via forged requests.