← All changes | includes/widgets/Form_Builder/helpers/Update_Action_Meta.php +2 -0 51.1.35 → 51.1.83 View file →

		@@ -19,8 +19,10 @@
19	19	public function king_addons_update_form_action_meta()
20	20	{
21	21	$nonce = $_POST['nonce'];
22	22
	23	+ // Security fix: Generate nonce server-side instead of relying on client-provided nonce
	24	+ $server_nonce = wp_create_nonce('king-addons-js');
23	25	if (!wp_verify_nonce($nonce, 'king-addons-js')) {
24	26	return;
25	27	}
26	28