Two Factor Authentication <= 1.3.12 - Disable Two Factor Authentication CSRF

According to the changelog: “Fix a logged-in CSRF vulnerability reported by Martijn Korse (www.bitnesswise.com). Due to a missing nonce check, if an attacker was able to persuade a personally-targetted victim who was currently logged in to their WordPress account to visit a personally-crafted (for the individual victim) page in the same browser session, then the attacker would be able to de-activate two-factor authentication for the victim on that WordPress site (thus leaving the targetted account protected by the user’s password, but not by a second factor - the absence of a request for a TFA code would be apparent on the user’s next login). This vulnerability was inherited from the original “Two Factor Auth” plugin that this plugin was forked from, and so is present in all versions before this one.”