rb_activate_included_plugin and rb_deactivate_included_plugin AJAX actions, which makes it possible for attackers to activate or deactivate addon plugins via a forged request if they can trick an administrator into performing an action such as clicking on a link. 