Incognito

The issue arises from a missing capability check on the ` submit uninstall reason action()` function, allowing authenticated attackers with Subscriber-level access and above to submit a deactivation reason on behalf of a site. This enables unauthorized submission of data.

The issue is due to missing or incorrect nonce validation on the `dpfl listingStatusChange()` function, making it possible for unauthenticated attackers to update listing statuses via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link.

The issue is related to a missing capability check on the `reorder route()` function, allowing unauthenticated attackers to modify data by reordering posts.

The issue is related to a missing capability check on the 'clear ecpay debug log' AJAX action. This allows authenticated attackers with Subscriber-level access and above to clear the plugin's log files, resulting in unauthorized loss of data.

The issue allows unauthorized modification of data due to a missing capability check on the `wooh action settings save frontend()` function. This makes it possible for unauthenticated attackers to update limited plugin settings.

The issue arises from a missing capability check on the `cancel import()` function, allowing authenticated attackers with Subscriber-level access and above to cancel and import or check on the status. This enables unauthorized access.

The issue is related to a missing capability check on the `removeorder` AJAX action, allowing authenticated attackers with Subscriber-level access and above to delete orders. This makes it possible for attackers to modify data without proper authorization.

The issue arises from a missing capability check on the `buy one click export options` AJAX action, allowing authenticated attackers with Subscriber-level access and above to export plugin settings. This results in unauthorized access of data.

The issue is related to a missing capability check on the `buy one click import options` AJAX action, allowing authenticated attackers with Subscriber-level access and above to import plugin settings, thus enabling unauthorized modification of data.

The issue is related to a missing capability check on the `remove unused thumbnails()` function, allowing unauthenticated attackers to delete thumbnails in the `video-wc-gallery-thumb` directory. This enables unauthorized modification of data.

The issue is related to a missing capability check on the `wprss ajax send premium support` function, allowing authenticated attackers with Subscriber-level access and above to send premium support requests with controlled subject lines and email addresses, potentially impersonating the site owner. This could also lead to the leakage of license information.