Broken Access Control in Ninja Forms Telemetry REST Endpoint

The telemetry REST route's permission callback only required a logged-in user, so any authenticated user including a subscriber could write arbitrary data into the wp_options table. The route now requires the manage_options capability and validates and sanitises the submitted payload. This vulnerability affects the following application versions:... Weiterlesen: Broken Access Control in Ninja Forms Telemetry REST Endpoint