Nexter Extension - PRO — about 1 month ago

• Improvement :

• Security : added missing file guards across 15 files and switched a token comparison to a timing-safe check

• Fixed :

• Security : Media Replacement no longer lets a user read or permanently delete another user's attachment via a swapped ID

• Fixed :

• Security : license activate/deactivate and notice-dismiss AJAX now require Administrator, not just a valid nonce

• Fixed :

• Security : Admin Menu Organizer's "always hide for role(s)" now actually blocks the page server-side instead of only hiding the menu link

• Fixed :

• Security : Admin Menu Organizer no longer permanently grants Contact Form 7 access down to Subscriber

• Fixed :

• Security : the [nxt_encode] shortcode no longer accepts a javascript: link

• Fixed :

• Security : "Hide Author URLs" now generates a truly random slug instead of one derived from the site's own public plugin URL

• Fixed :

• Security : Local User Avatar no longer accepts an arbitrary attachment ID, and a crafted filename can no longer corrupt the output

• Fixed :

• Security : 2FA code resend is now rate-limited and POST-only; recovery codes restored to a safe length

• Fixed : two 2FA REST endpoints that always failed due to a wrong class/provider name

• Fixed :

• Security : Settings Import now sanitises every imported value and no longer exports the license key