{"id":18995374,"date":"2026-08-17T10:07:01","date_gmt":"2026-08-17T10:07:01","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/missing-authorization-broken-access-control\/"},"modified":"2026-08-17T10:07:01","modified_gmt":"2026-08-17T10:07:01","slug":"missing-authorization-broken-access-control","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/missing-authorization-broken-access-control\/","title":{"rendered":"Missing Authorization \/ Broken Access Control"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I\u2019m writing about CVE-2025-64294 (Missing Authorization \/ Broken Access Control to notice dismissal) in WP Snow Effect \u2264 1.1.19.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The review-notice dismissal handler&nbsp;<code>wp_snow_effect_set_no_bug()<\/code>&nbsp;is hooked to&nbsp;<code>admin_init<\/code>&nbsp;and updates options when&nbsp;<code>?wpsenobug=1<\/code>&nbsp;is present. It does not check&nbsp;<code>current_user_can()<\/code>&nbsp;and does not verify a nonce. Because&nbsp;<code>admin_init<\/code>&nbsp;also runs on&nbsp;<code>admin-ajax.php<\/code>&nbsp;(no login redirect), this action can be triggered without proper authorization.&nbsp;<code>wp_snow_effect_check_installation_date()<\/code>&nbsp;has the same gap: it writes plugin options on&nbsp;<code>admin_init<\/code>&nbsp;without a capability check.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Suggested fix:<\/p>\n\n\n\n<ol>\n<li>Move dismissal off\u00a0<code>admin_init<\/code>\u00a0to\u00a0<code>admin_post_wpse_dismiss_notice<\/code>\u00a0(do not register a nopriv hook).<\/li>\n\n\n\n<li>In the handler, require\u00a0<code>current_user_can( 'manage_options' )<\/code>\u00a0and\u00a0<code>check_admin_referer( 'wpse_dismiss_notice' )<\/code>.<\/li>\n\n\n\n<li>Build the \u201cLeave Me Alone\u201d URL with\u00a0<code>wp_nonce_url( admin_url( 'admin-post.php?action=wpse_dismiss_notice' ), 'wpse_dismiss_notice' )<\/code>.<\/li>\n\n\n\n<li>Guard\u00a0<code>wp_snow_effect_check_installation_date()<\/code>\u00a0with\u00a0<code>current_user_can( 'manage_options' )<\/code>\u00a0so unauthenticated\/low-privilege requests cannot write options.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Happy to provide a patch if that helps.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kind regards from Germany,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Florian<\/p>\n","protected":false},"template":"","class_list":["post-18995374","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18995374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18995374\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18995374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}