WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Missing Authorization

// includes/plugin-pages.php lines 19-30
public function __construct() {
  
  $this->data=$this->get_data_object();
global $pagenow;
  if(in_array($pagenow, array("admin-ajax.php"))){
  add_action('wp_ajax_update_feed_'.$this->id, array($this, 'update_feed'));
  add_action('wp_ajax_update_feed_sort_'.$this->id, array($this, 'update_feed_sort'));
  add_action('wp_ajax_get_field_map_'.$this->id, array($this, 'get_field_map_ajax'));
  add_action('wp_ajax_get_field_map_object_'.$this->id, array($this, 'get_field_map_object_ajax'));
  add_action('wp_ajax_get_objects_'.$this->id, array($this, 'get_objects_ajax'));
  add_action('wp_ajax_log_detail_'.$this->id, array($this, 'log_detail'));
   add_action('wp_ajax_refresh_data_'.$this->id, array($this, 'refresh_data')); 
  add_action('wp_ajax_send_to_crm_'.$this->id, array($this, 'send_to_crm')); 
  }

---

// includes/plugin-pages.php line 1416 (v1.1.5)
public function log_detail(){
$log_id=$this->post('id');
$log=$this->data->get_log_by_id($log_id); 
  $data=json_decode($log['data'],true);

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/cf7-insightly/1.1.5/cf7-insightly.php /home/deploy/wp-safety.org/data/plugin-versions/cf7-insightly/1.1.6/cf7-insightly.php
--- /home/deploy/wp-safety.org/data/plugin-versions/cf7-insightly/1.1.5/cf7-insightly.php	2025-05-22 11:22:26.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/cf7-insightly/1.1.6/cf7-insightly.php	2026-02-23 16:56:48.000000000 +0000
@@ -2,7 +2,7 @@
 /**
 * Plugin Name: WP Contact Form Insightly
 * Description: Integrates Contact Form 7, Ninja Forms, <a href="https://wordpress.org/plugins/contact-form-entries/">Contact Form Entries Plugin</a> and many other forms with Insightly allowing form submissions to be automatically sent to your Insightly account 
-* Version: 1.1.5
+* Version: 1.1.6
 * Requires at least: 3.8
 * Author URI: https://www.crmperks.com
 * Plugin URI: https://www.crmperks.com/plugins/contact-form-plugins/contact-form-insightly-plugin/
@@ -24,7 +24,7 @@
   public  $crm_name = "insightly";
   public  $id = "vxcf_insightly";
   public  $domain = "vxcf-insightly";
-  public  $version = "1.1.5";
+  public  $version = "1.1.6";
   public  $update_id = "6000001";
   public  $min_cf_version = "1.0";
   public $type = "vxcf_insightly";
@@ -118,18 +118,7 @@
   add_action('init', array($this,'init'));
        //loading translations
 load_plugin_textdomain('contact-form-insightly-crm', FALSE,  $this->plugin_dir_name(). '/languages/' );
-  
-  self::$db_version=get_option($this->type."_version");
-  if(self::$db_version != $this->version && current_user_can( 'manage_options' )){
-  $data=$this->get_data_object();
-  $data->update_table();
-  update_option($this->type."_version", $this->version);
-  //add post permissions
-  require_once(self::$path . "includes/install.php"); 
-  $install=new vxcf_insightly_install();
-  $install->create_roles();   
-
-  }
+$this->maybe_install(true);  
 }
   
   }
@@ -149,6 +138,27 @@
 self::$plugin->instance();
 }
 } }
+public function maybe_install($version_check=false){
+    
+  if(current_user_can( 'manage_options' )){
+  self::$db_version=get_option($this->type."_version");
+     $do_install=false;
+      if($version_check == false){
+        $do_install=true;  
+      }else if(self::$db_version != $this->version){
+        $do_install=true;   
+      }
+  if($do_install){
+  $data=$this->get_data_object();
+  $data->update_table();
+  update_option($this->type."_version", $this->version);
+  //add post permissions
+  require_once(self::$path . "includes/install.php"); 
+  $install=new vxcf_insightly_install();
+  $install->create_roles();   
+  }
+  } 
+}
 
  public function form_submitted($form){ 
 
@@ -508,29 +518,6 @@
   echo wp_kses_post($message) ;
   echo '</p></div>';
   } 
-
-
-  /**
-  * create tables and roles
-  * 
-  */
-  public function install(){
-      
-  if(current_user_can( 'manage_options' )){
-  self::$db_version=get_option($this->type."_version");
-  if(self::$db_version != $this->version){
-  $data=$this->get_data_object();
-  $data->update_table();
-  update_option($this->type."_version", $this->version);
-  //add post permissions
-  require_once(self::$path . "includes/install.php"); 
-  $install=new vxcf_insightly_install();
-  $install->create_roles();   
-
-  }
-
-  } 
-  }
 /**
 * Contact Form status
 * 
@@ -1275,6 +1262,7 @@
   */
   public function activate(){ 
 $this->plugin_api(true);
+$this->maybe_install();
 do_action('plugin_status_'.$this->type,'activate');  
   }
     /**
@@ -1414,6 +1414,11 @@
   * 
   */
   public function log_detail(){
+          check_ajax_referer('vx_crm_ajax','vx_crm_ajax');
+      if(!current_user_can($this->id.'_read_logs')){
+  esc_html_e('You do not have permissions to access this page','cf7-insightly');    
+  return;
+  }
 $log_id=$this->post('id');
 $log=$this->data->get_log_by_id($log_id); 
   $data=json_decode($log['data'],true);