{"id":18898536,"date":"2026-05-04T17:12:19","date_gmt":"2026-05-04T17:12:19","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/public-security-patch\/"},"modified":"2026-05-04T17:15:11","modified_gmt":"2026-05-04T17:15:11","slug":"public-security-patch","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/public-security-patch\/","title":{"rendered":"Public Security Patch"},"content":{"rendered":"\n

A client of mine really enjoys this plugin but the security issues must be addressed. I am posting the patches I made to this plugin to address the two major security issues. The Broken Access Control and CSRF issue.
<\/p>\n\n\n\n

==============================================
WORDPRESS PLUGIN SECURITY FIXES
Mega Addons For WPBakery Page Builder Version 4.3.0 -> 4.3.1<\/p>\n\n\n\n

============================================== <\/p>\n\n\n\n

FILE 1: main.php<\/p>\n\n\n\n

Line 87-99 – SECURITY FIX: Added nonce verification AND capability check <\/p>\n\n\n\n

BEFORE:<\/p>\n\n\n\n

function vc_saving_data() {
if (isset($_REQUEST)) {

    \/\/ Sanitizing $_REQUEST before saving
    $vc_save_data = array_map( 'sanitize_text_field', $_REQUEST );
    update_option( 'vc_save_data', $vc_save_data );

}

}<\/code><\/pre>\n\n\n\n
 AFTER:<\/p>\n\n\n\n
function vc_saving_data() {
check_ajax_referer( 'vc_mega_addons_nonce', 'nonce' );

if ( ! current_user_can( 'manage_options' ) ) {
    wp_die( __( 'Unauthorized', 'mega-addons' ) );
}

if (isset($_REQUEST)) {
    $vc_save_data = array_map( 'sanitize_text_field', $_REQUEST );
    update_option( 'vc_save_data', $vc_save_data );

}

}<\/code><\/pre>\n\n\n\n
CHANGES MADE:<\/p>\n\n\n\n
    \n
  • Line 88: Added check_ajax_referer( ‘vc_mega_addons_nonce’, ‘nonce’ );<\/li>\n\n\n\n
  • Lines 90-92: Added capability check for manage_options<\/li>\n<\/ul>\n\n\n\n
    Line 117 – VERSION UPDATE
    BEFORE:<\/p>\n\n\n\n
    <p>Version 4.3.0<\/p><\/code><\/pre>\n\n\n\n
    AFTER:<\/p>\n\n\n\n
    <p>Version 4.3.1<\/p><\/code><\/pre>\n\n\n\n
    ============================================== <\/p>\n\n\n\n
    FILE 2: includes\/settings.php<\/p>\n\n\n\n
    Line 13-15 – SECURITY FIX: Added nonce field<\/p>\n\n\n\n
    BEFORE:<\/p>\n\n\n\n
    <form id=\"addonsdata\">
        <table class=\"form-table\"><\/code><\/pre>\n\n\n\n

    AFTER:<\/p>\n\n\n\n
    <form id=\"addonsdata\">
        <?php wp_nonce_field( 'vc_mega_addons_save', 'vc_mega_addons_nonce' ); ?>
        <table class=\"form-table\"><\/code><\/pre>\n\n\n\n
    CHANGES MADE:<\/p>\n\n\n\n
    - Line 14: Added <?php wp_nonce_field( 'vc_mega_addons_save', 'vc_mega_addons_nonce' ); ?><\/code><\/pre>\n\n\n\n
    ==============================================<\/p>\n\n\n\n
    FILE 3: lib\/admin.js<\/p>\n\n\n\n
    Line 7 – SECURITY FIX: Added nonce to AJAX call<\/p>\n\n\n\n
    BEFORE:<\/p>\n\n\n\n
    data = data + '&action=vc_save_data';<\/code><\/pre>\n\n\n\n
    AFTER:<\/p>\n\n\n\n
    data = data + '&action=vc_save_data&nonce=' + jQuery('#vc_mega_addons_nonce').val();<\/code><\/pre>\n\n\n\n
    CHANGES MADE:<\/p>\n\n\n\n
      \n
    • Line 7: Added nonce parameter to AJAX data<\/li>\n<\/ul>\n\n\n\n
      ==============================================<\/p>\n\n\n\n
      FILE 4: index.php<\/p>\n\n\n\n
      Line 8 – VERSION UPDATE<\/p>\n\n\n\n
      BEFORE:<\/p>\n\n\n\n
      Version: 4.3.0<\/code><\/pre>\n\n\n\n
      AFTER:<\/p>\n\n\n\n
      Version: 4.3.1<\/code><\/pre>\n\n\n\n
      ==============================================<\/p>\n\n\n\n
      SECURITY ISSUES FIXED:<\/p>\n\n\n\n
        \n
      1. CSRF (Cross-Site Request Forgery)<\/li>\n<\/ol>\n\n\n\n
          \n
        • The AJAX action vc_save_data had no nonce verification<\/li>\n\n\n\n
        • Attackers could trick authenticated admins to submit forms 

          FIX: Added check_ajax_referer() and wp_nonce_field()<\/li>\n<\/ul>\n\n\n\n
            \n
          1. Broken Access Control (Subscriber+ Settings Update)<\/li>\n<\/ol>\n\n\n\n
              \n
            • No capability check – any logged-in user could update settings<\/li>\n\n\n\n
            • Should require ‘manage_options’ capability (admin only)

              FIX: Added current_user_can( ‘manage_options’ ) check<\/li>\n<\/ul>\n\n\n\n
              ==============================================<\/p>\n\n\n\n
              SUMMARY OF CHANGES:<\/p>\n\n\n\n
              main.php – 3 changes (nonce check, capability check, version)
              includes\/settings.php – 1 change (nonce field)
              lib\/admin.js – 1 change (nonce in ajax)
              index.php – 1 change (version)<\/p>\n\n\n\n
              Total files modified: 4
              Total changes: 6
              <\/p>\n\n\n\n
              I hope this helps others. User Note: I have not independently verified that this closed or fixes the two currently known security issues with this plugin. This is my best personal attempt at solving them in the short term until an official patch is released. Please use this information and patch details at your own risk.<\/p>\n","protected":false},"template":"","class_list":["post-18898536","topic","type-topic","status-publish","hentry","topic-tag-update"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18898536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18898536\/revisions"}],"predecessor-version":[{"id":18898539,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18898536\/revisions\/18898539"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18898536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}