wpForo Forum <= 3.1.0 - Missing Authorization

', ...);
}
});
```
This notice is shown in the admin.
Wait, there's an AJAX action wpforo_notice_dismiss that wpForo uses globally.

*   Let's refine the "Unauthorized Action".
*   If it's `wp_ajax_nopriv_wpforo_notice_dismiss`, any unauthenticated user can call:
    `POST /wp-admin/admin-ajax.php`
    `action=wpforo_notice_dismiss&notice_id=...`
    This would dismiss notices for the admin.

*   Wait, look at `Members.php` line 115: `wpforo_after_activate_user`.
*   This is a hook. What calls `do_action('wpforo_after_activate_user', ...)`?
*   It's usually the `activate()` method in `Members.php`.

*   Let's look for how `activate()` is called.
*   If there's an `init` hook that checks for `$_GET['wpfaction'] == 'activate'`.
*   In wpForo 3.1.0, the logic for `wpfaction=activate` was:
    ```php
    if (wpfval($_GET, 'wpfaction') == 'activate') {
        $userid = intval($_GET['uid']);
        $key = $_GET['key'];