| @@ -31,8 +31,14 @@ | ||
| 31 | 31 | return $widgets; |
| 32 | 32 | } |
| 33 | 33 | |
| 34 | 34 | public function callback_ajax_loadmore_posts() { |
| 35 | + // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before | |
| 36 | + // processing this public load-more request. | |
| 37 | + if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) { | |
| 38 | + wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 ); | |
| 39 | + } | |
| 40 | + | |
| 35 | 41 | |
| 36 | 42 | $settings = []; |
| 37 | 43 | |
| 38 | 44 | if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) { |
