Murd0Ck

**Name of the Vulnerable Software and Affected Versions** Layouts for WPBakery versions prior to 1.1.4 **Description** The plugin is susceptible to unauthorized actions because of a missing capability check in the `Layouts WPB Remote::template sync()` callback, which is registered through `wp ajax nopriv handle sync`. This flaw allows unauthenticated attackers to compel the WordPress server to send outbound HTTP requests to the vendor's external API endpoints `https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`. Subsequently, the JSON-decoded responses are written directly into the `wp options` table using the `set transient()` function. The process lacks nonce verification, capability checks, and rate limiting. **Recommendations** Update the plugin to a version later than 1.1.3.