TinyMCE Advanced Plugin for WordPress contains a flaw as HTTP requests to options-general.php do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to reset settings to their default values.