Client Portal – Private user pages and login <= 1.2.1 - Missing Authorization

_pages_in_bulk' ) );
```
Is there a nonce check in the standard bulk action workflow?
When you use a bulk action in WordPress, the form usually has a _wpnonce and an action and action2.
If the plugin's cp_create_private_pages_in_bulk function calls check_admin_referer('bulk-users'), it's checking the core WP nonce for the users page.
If it calls check_admin_referer('cp_create_private_page_nonce'), it's checking its own.
If it calls neither, it's completely unprotected against CSRF and AuthZ.
Given 1.1.9 "Fix: CSRF issue", it's likely it does check a nonce now.
But which one?
If it checks bulk-users, a Subscriber can't get it.
If it checks a custom one, I need to find where it's exposed.

Let's look at `index.php` again for where nonces are created.
The `cp_enqueue_admin_scripts` function is hooked to `admin_enqueue_scripts`. This runs on *all* admin pages for any logged-in user.
If the nonce is created there, the Subscriber can get it.

*   **JavaScript Variable for Nonce:**
    I will guess the variable name based on the plugin slug `client