The bbp-move-topics plugin prior to 1.1.6 for WordPress has CSRF.
bbpress move topics project bbpress move topics