Blocksy < 2.0.98 - Missing Authorization

Description

The Blocksy theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_blocksy_notice_button_click AJAX endpoint in versions up to, and including, 2.0.97. This makes it possible for authenticated attackers, with administrator-level access and above, to install plugins. This would only impact sites where administrators have been stripped of their capability to install and activate plugins, which might occur on multi-sites.