birdseedapp vulnerabilities and threats

The BirdSeed WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.2.0. The vulnerability arises from missing nonce validation in the birdseed_plugin_settings_page() function, which processes a 'birdseed_token' GET parameter and saves it without verifying the request's authenticity. This allows an attacker to trick an administrator into changing the plugin's token setting via a forged request.