Title: Missing Authorization / Broken Access Control
Last modified: August 17, 2026

---

# Missing Authorization / Broken Access Control

 *  [airflo](https://wordpress.org/support/users/airflo/)
 * (@airflo)
 * [3 weeks ago](https://wordpress.org/support/topic/missing-authorization-broken-access-control/)
 * Hi,
 * I’m writing about CVE-2025-64294 (Missing Authorization / Broken Access Control
   to notice dismissal) in WP Snow Effect ≤ 1.1.19.
 * The review-notice dismissal handler `wp_snow_effect_set_no_bug()` is hooked to`
   admin_init` and updates options when `?wpsenobug=1` is present. It does not check`
   current_user_can()` and does not verify a nonce. Because `admin_init` also runs
   on `admin-ajax.php` (no login redirect), this action can be triggered without
   proper authorization. `wp_snow_effect_check_installation_date()` has the same
   gap: it writes plugin options on `admin_init` without a capability check.
 * Suggested fix:
    1. Move dismissal off `admin_init` to `admin_post_wpse_dismiss_notice` (do not 
       register a nopriv hook).
    2. In the handler, require `current_user_can( 'manage_options' )` and `check_admin_referer('
       wpse_dismiss_notice' )`.
    3. Build the “Leave Me Alone” URL with `wp_nonce_url( admin_url( 'admin-post.php?
       action=wpse_dismiss_notice' ), 'wpse_dismiss_notice' )`.
    4. Guard `wp_snow_effect_check_installation_date()` with `current_user_can( 'manage_options')`
       so unauthenticated/low-privilege requests cannot write options.
 * Happy to provide a patch if that helps.
 * Kind regards from Germany,
 * Florian

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fmissing-authorization-broken-access-control%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/wp-snow-effect/assets/icon-128x128.png?rev=1293633)
 * [WP Snow Effect](https://wordpress.org/plugins/wp-snow-effect/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wp-snow-effect/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wp-snow-effect/)
 * [Active Topics](https://wordpress.org/support/plugin/wp-snow-effect/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wp-snow-effect/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wp-snow-effect/reviews/)

 * 0 replies
 * 1 participant
 * Last reply from: [airflo](https://wordpress.org/support/users/airflo/)
 * Last activity: [3 weeks ago](https://wordpress.org/support/topic/missing-authorization-broken-access-control/)
 * Status: not resolved