Exploiting authorization by nonce in WordPress plugins | Hacker News