[Security] Missing Authorization: Unauthenticated Email Templates Reset

[abdurazzoqovjavohir700-dev]

Security Vulnerability Report

Severity: MEDIUM (CVSS 5.3)
CWE: CWE-862 — Missing Authorization
Plugin: Job Board Manager v2.1.62 (WordPress.org)

Summary

The AJAX action job_bm_ajax_reset_email_templates_data is registered for unauthenticated users (wp_ajax_nopriv_). Any unauthenticated visitor can trigger this action and permanently reset all custom email templates to defaults — with no authentication check or nonce verification.

Vulnerable Code (includes/functions/functions.php lines 196-208)

function job_bm_ajax_reset_email_templates_data(){
    // NO auth check, NO nonce check
    update_option('job_bm_email_templates_data', $templates_data);
    die();
}
add_action('wp_ajax_nopriv_job_bm_ajax_reset_email_templates_data', ...);

PoC

curl -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=job_bm_ajax_reset_email_templates_data"

Fix

Remove the wp_ajax_nopriv_ registration and add current_user_can('manage_options') check.

Researcher

Javohir Abdurazzoqov — abdurazzoqovjavohir700@gmail.com
Disclosure Deadline: 2026-09-23 (90 days from 2026-06-25)