[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7JhORHnwFjf4XdXmfZPVeSUyj-QT9YaffHAZHytaOIA":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-57721","applyonline-application-form-builder-and-manager-missing-authorization-3","ApplyOnline – Application Form Builder and Manager \u003C= 2.6.7.6 - Missing Authorization","The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.6.7.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.","apply-online",null,"\u003C=2.6.7.6","2.6.8","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-01 00:00:00","2026-07-07 19:43:28",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc3dbae56-d28f-4d57-848d-8cf0d0c0cffc?source=api-prod",7,[22,23,24,25,26,27,28],"README.txt","admin\u002Fclass-applyonline-admin.php","apply-online.php","includes\u002Fapplyonline-functions.php","includes\u002Fclass-applyonline-activator.php","includes\u002Fclass-applyonline-updater.php","includes\u002Fclass-applyonline.php","researched",false,3,"# CVE-2026-57721 - ApplyOnline Missing Authorization Research Plan\n\nThis plan outlines the exploitation strategy for a missing authorization vulnerability in the ApplyOnline plugin. The vulnerability allows unauthenticated users to perform an unauthorized action, specifically dismissing administrative notices, which modifies the site configuration in the database.\n\n## 1. Vulnerability Summary\nThe **ApplyOnline** plugin (versions \u003C= 2.6.7.6) fails to perform a capability check in its AJAX handler for dismissing administrative notices. The action `aol_dismiss_notice` is registered via `wp_ajax_aol_dismiss_notice` (and inferred `wp_ajax_nopriv_aol_dismiss_notice` in the public component) but the callback function `admin_dismiss_notice` does not verify if the user has administrative privileges (e.g., `manage_options`) or validate a request nonce.\n\n- **Vulnerable Action:** `aol_dismiss_notice`\n- **Vulnerable Function:** `Applyonline_Admin::admin_dismiss_notice`\n- **Vulnerable File:** `admin\u002Fclass-applyonline-admin.php`\n- **Impact:** Integrity (Low). Unauthenticated attackers can suppress critical administrator notices or pollute the `aol_admin_notices` database option.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method:** POST\n- **Action:** `aol_dismiss_notice`\n- **Payload Parameter:** `notice`\n- **Authentication:** None (","The ApplyOnline plugin for WordPress is vulnerable to unauthorized access and modification of site settings due to a missing capability check and nonce validation in its AJAX handler for dismissing administrative notices. This allows unauthenticated attackers to suppress important administrator notifications or pollute the plugin's notice configuration in the database.","\u002F\u002F includes\u002Fclass-applyonline.php lines 257-258\n$this->loader->add_action('admin_notices', $plugin_admin, 'admin_notice');\n$this->loader->add_action('wp_ajax_aol_dismiss_notice', $plugin_admin, 'admin_dismiss_notice');\n\n---\n\n\u002F\u002F admin\u002Fclass-applyonline-admin.php (inferred implementation based on research plan)\npublic function admin_dismiss_notice() {\n    $notice = $_POST['notice'];\n    \u002F\u002F Missing capability check (e.g., current_user_can('manage_options'))\n    \u002F\u002F Missing nonce verification (e.g., check_ajax_referer())\n    $notices = (array)get_option( 'aol_admin_notices' );\n    $notices[] = $notice;\n    update_option( 'aol_admin_notices', $notices );\n    wp_die();\n}","--- a\u002Fadmin\u002Fclass-applyonline-admin.php\n+++ b\u002Fadmin\u002Fclass-applyonline-admin.php\n@@ -200,6 +200,10 @@\n \tpublic function admin_dismiss_notice() {\n+\t\tif ( ! current_user_can( 'manage_options' ) ) {\n+\t\t\twp_die( esc_html__( 'You are not allowed to perform this action.', 'apply-online' ) );\n+\t\t}\n+\t\tcheck_ajax_referer( 'aol_nonce', 'security' );\n \t\t$notice = $_POST['notice'];\n \t\t$notices = (array)get_option( 'aol_admin_notices' );\n \t\t$notices[] = $notice;\n \t\tupdate_option( 'aol_admin_notices', $notices );\n \t\twp_die();\n \t}","The vulnerability is exploited by sending a POST request to the WordPress AJAX endpoint. \n\n1. Endpoint: \u002Fwp-admin\u002Fadmin-ajax.php\n2. Action: aol_dismiss_notice\n3. Payload: A POST request containing the parameter 'notice' set to the slug of an administrative notice the attacker wishes to suppress.\n4. Authentication: Although registered as a standard AJAX action, the lack of permission checks allows unauthenticated or low-privileged users to trigger the function if the 'nopriv' variant is present or if the environment allows unauthorized AJAX execution. The handler fails to verify if the requestor has the 'manage_options' capability or provides a valid security nonce, resulting in the 'aol_admin_notices' option being updated in the database without authorization.","gemini-3-flash-preview","2026-07-25 12:10:12","2026-07-25 12:11:44",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","2.6.7.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fapply-online\u002Ftags\u002F2.6.7.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fapply-online.2.6.7.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fapply-online\u002Ftags\u002F2.6.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fapply-online.2.6.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fapply-online\u002Ftags"]