Security & Malware scan by CleanTalk < 2.51 - Security Nonce Leak leading to Unauthorised AJAX call

Description

Security nonce leak, allowing any authenticated users (such as subscribers) to make unauthorised AJAX call which could lead to arbitrary file deletion/download and function call.

Note (WPScanTeam): We do not consider the issue fully remediated, as the AJAX calls rely on CSRF check for authorisation, instead of proper authorisation verification with the current_user_can() function. However, it would require chaining with other issues to be exploited.