Patchstack vuln fix for WPLMS 3.9.9 CSRF

Last updated on by

Since we are no longer providing automatic updates to users with WPLMS verison.

Here is the changes that you need to do to apply this fix.

1. Login to your WP admin dashboard

2. Go to WP admin – Appearance – Theme Editor 

3. Select WPLMS theme

4. locate file wplms – includes – actions.php

5. Location function -> function import_data(){

6. Change the function to this :

function import_data(){
		if(!current_user_can('manage_options') || (!empty($_POST['security']) || !wp_verify_nonce($_POST['security'],'security')))
  			die();

		$name = esc_attr($_POST['name']);
		if(in_array($name,['vibe_builder_sample_layouts','vibe_customizer','widgets_settings','sidebars_widgets'])){
			
			$code = trim($_POST['code']); 
	    	$code = json_decode(stripslashes($code),true);
			$value = get_option($name);
			if(isset($value)){
	      		update_option($name,$code);
			}else{
				echo "Error, Option does not exist !";
			}
		}
		die();
	}