The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.

%d bloggers like this: