WP Dependency Installer < 4.3.1 - Arbitrary Plugin Installation from Dependency via CSRF

The wp-dependency-installer library, used in the plugins, does not have CSRF check in its dependencyinstaller AJAX action with the install method, which could allow attackers to make a logged in admin install plugins defined in the wp-dependencies.json via a CSRF attack. The slug has to be presen...