Facebook token modification via missing nonce validation

CSRF in Smash Balloon Social Post Feed 4.2.1 and earlier allows remote attackers to reset or replace a Facebook token via a forged request. The maybe_source_connection_data() function processes the token-changing request without correctly validating a WordPress nonce, so it accepts a request initiated outside the site. Exploitation requires a logged-in site administrator to follow an attacker-controlled link or otherwise submit the forged request; the bounded result is unauthorized modification of the plugin's Facebook connection token.