Missing Authorization / Broken Access Control

Hi,

I’m writing about CVE-2025-64294 (Missing Authorization / Broken Access Control to notice dismissal) in WP Snow Effect ≤ 1.1.19.

The review-notice dismissal handler wp_snow_effect_set_no_bug() is hooked to admin_init and updates options when ?wpsenobug=1 is present. It does not check current_user_can() and does not verify a nonce. Because admin_init also runs on admin-ajax.php (no login redirect), this action can be triggered without proper authorization. wp_snow_effect_check_installation_date() has the same gap: it writes plugin options on admin_init without a capability check.

Suggested fix:

1. Move dismissal off admin_init to admin_post_wpse_dismiss_notice (do not register a nopriv hook).
2. In the handler, require current_user_can( 'manage_options' ) and check_admin_referer( 'wpse_dismiss_notice' ).
3. Build the “Leave Me Alone” URL with wp_nonce_url( admin_url( 'admin-post.php?action=wpse_dismiss_notice' ), 'wpse_dismiss_notice' ).
4. Guard wp_snow_effect_check_installation_date() with current_user_can( 'manage_options' ) so unauthenticated/low-privilege requests cannot write options.

Happy to provide a patch if that helps.

Kind regards from Germany,

Florian