WP Marketing Automations 3.6.0 REST API Permission Callback Fix

From this webpage screenshot, the following key vulnerability-related information can be obtained: File Path: Commit ID: 3305437 Commit Time: June 6, 2025, 05:19:21 AM (3 weeks ago) Committer: amiris2k Version Update: New version 3.6.0 Key Code Changes: php $route_args['permission_callback'] = [ __CLASS__, 'rest_permission_callback' ]; php $route_args['permission_callback'] = [ $api, 'rest_permission_callback' ]; php public static function rest_permission_callback( WP_REST_Request $request ) { $query_params = $request->get_query_params(); if ( isset( $query_params['bwf_nonce'] ) && $query_params['bwf_nonce'] === get_option('bwfan_u_key', '') ) { return true; } $permissions = BWFAN_Common::access_capabilities(); foreach ( $permissions as $permission ) { if ( current_user_can( $permission ) ) { return true; } } return false; } Potential Vulnerability Analysis: Permission Validation Issue: In the original code, the constant was used to invoke the permission callback, which could introduce security risks related to reflection calls. The updated code uses the object instead, potentially improving security. Nonce Verification: The newly added method includes validation for the parameter, helping to prevent Cross-Site Request Forgery (CSRF) attacks. User Permission Check: The method also verifies whether the current user has any of the specified capabilities, further enhancing security. These changes indicate that the developer has made efforts to strengthen permission validation and overall security for API routes.

Goal Reached Thanks to every supporter — we hit 100%!

WP Marketing Automations 3.6.0 REST API Permission Callback Fix