WP-Safety
CVE-2026-57721

ApplyOnline – Application Form Builder and Manager <= 2.6.7.6 - Missing Authorization

mediumMissing Authorization
5.3
CVSS Score
5.3
CVSS Score
medium
Severity
2.6.8
Patched in
7d
Time to patch

Description

The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.6.7.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=2.6.7.6
PublishedJuly 1, 2026
Last updatedJuly 7, 2026
Affected pluginapply-online

What Changed in the Fix

Changes introduced in v2.6.8

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v2.6.7.6
Browse source Download .zip
Patched v2.6.8
Browse source Download .zip
Research Plan
Unverified

# CVE-2026-57721 - ApplyOnline Missing Authorization Research Plan This plan outlines the exploitation strategy for a missing authorization vulnerability in the ApplyOnline plugin. The vulnerability allows unauthenticated users to perform an unauthorized action, specifically dismissing administrati…

Show full research plan

CVE-2026-57721 - ApplyOnline Missing Authorization Research Plan

This plan outlines the exploitation strategy for a missing authorization vulnerability in the ApplyOnline plugin. The vulnerability allows unauthenticated users to perform an unauthorized action, specifically dismissing administrative notices, which modifies the site configuration in the database.

1. Vulnerability Summary

The ApplyOnline plugin (versions <= 2.6.7.6) fails to perform a capability check in its AJAX handler for dismissing administrative notices. The action aol_dismiss_notice is registered via wp_ajax_aol_dismiss_notice (and inferred wp_ajax_nopriv_aol_dismiss_notice in the public component) but the callback function admin_dismiss_notice does not verify if the user has administrative privileges (e.g., manage_options) or validate a request nonce.

  • Vulnerable Action: aol_dismiss_notice
  • Vulnerable Function: Applyonline_Admin::admin_dismiss_notice
  • Vulnerable File: admin/class-applyonline-admin.php
  • Impact: Integrity (Low). Unauthenticated attackers can suppress critical administrator notices or pollute the aol_admin_notices database option.

2. Attack Vector Analysis

  • Endpoint: /wp-admin/admin-ajax.php
  • Method: POST
  • Action: aol_dismiss_notice
  • Payload Parameter: notice
  • Authentication: None (
Research Findings
Static analysis — not yet PoC-verified

Summary

The ApplyOnline plugin for WordPress is vulnerable to unauthorized access and modification of site settings due to a missing capability check and nonce validation in its AJAX handler for dismissing administrative notices. This allows unauthenticated attackers to suppress important administrator notifications or pollute the plugin's notice configuration in the database.

Vulnerable Code

// includes/class-applyonline.php lines 257-258
$this->loader->add_action('admin_notices', $plugin_admin, 'admin_notice');
$this->loader->add_action('wp_ajax_aol_dismiss_notice', $plugin_admin, 'admin_dismiss_notice');

---

// admin/class-applyonline-admin.php (inferred implementation based on research plan)
public function admin_dismiss_notice() {
    $notice = $_POST['notice'];
    // Missing capability check (e.g., current_user_can('manage_options'))
    // Missing nonce verification (e.g., check_ajax_referer())
    $notices = (array)get_option( 'aol_admin_notices' );
    $notices[] = $notice;
    update_option( 'aol_admin_notices', $notices );
    wp_die();
}

Security Fix

--- a/admin/class-applyonline-admin.php
+++ b/admin/class-applyonline-admin.php
@@ -200,6 +200,10 @@
 	public function admin_dismiss_notice() {
+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_die( esc_html__( 'You are not allowed to perform this action.', 'apply-online' ) );
+		}
+		check_ajax_referer( 'aol_nonce', 'security' );
 		$notice = $_POST['notice'];
 		$notices = (array)get_option( 'aol_admin_notices' );
 		$notices[] = $notice;
 		update_option( 'aol_admin_notices', $notices );
 		wp_die();
 	}

Exploit Outline

The vulnerability is exploited by sending a POST request to the WordPress AJAX endpoint. 1. Endpoint: /wp-admin/admin-ajax.php 2. Action: aol_dismiss_notice 3. Payload: A POST request containing the parameter 'notice' set to the slug of an administrative notice the attacker wishes to suppress. 4. Authentication: Although registered as a standard AJAX action, the lack of permission checks allows unauthenticated or low-privileged users to trigger the function if the 'nopriv' variant is present or if the environment allows unauthorized AJAX execution. The handler fails to verify if the requestor has the 'manage_options' capability or provides a valid security nonce, resulting in the 'aol_admin_notices' option being updated in the database without authorization.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/c3dbae56-d28f-4d57-848d-8cf0d0c0cffc?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database