{"id":10161935,"date":"2018-04-09T15:36:15","date_gmt":"2018-04-09T15:36:15","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/security-issue-87\/"},"modified":"2018-04-09T15:39:45","modified_gmt":"2018-04-09T15:39:45","slug":"security-issue-87","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/security-issue-87\/","title":{"rendered":"Security issue"},"content":{"rendered":"<p>This plugin is not secure because it allows any visitor to the site to modify any user&#8217;s options!<\/p>\n<p>All you have to do is build a URL like this:<br \/>\nhttps:\/\/www.example.com\/members\/the-member-that-will-be-affected\/settings\/privacy-settings\/<\/p>\n<p>I&#8217;m already using the bp_is_my_profile () function to protect my users. While this serious problem is not solved, in my view.<\/p>\n<p>The idea of the plugin is very good, however it needs some work!<\/p>\n","protected":false},"template":"","class_list":["post-10161935","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10161935","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":4,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10161935\/revisions"}],"predecessor-version":[{"id":10161949,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10161935\/revisions\/10161949"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=10161935"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}