From 9394b91144935a6566c73a8b95dece2e32b9957c Mon Sep 17 00:00:00 2001 From: TallblokeUK Date: Sat, 29 Aug 2026 17:50:03 +0100 Subject: [PATCH] fix: correct the nonce argument in the version switch AJAX handlers check_ajax_referer() reads its second argument as the name of the request key holding the nonce, but both handlers passed the nonce value itself. WordPress looked for $_REQUEST[''], found nothing, fell through to _ajax_nonce and _wpnonce which the front end does not send, and ended up verifying an empty string. Both handlers therefore rejected every request with a 403, including requests carrying a valid nonce, so Switch Version and Refresh Available Versions did nothing. Passing the key name lets a valid nonce through while an invalid one is still rejected. --- src/php/Settings/Version_Switch.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/php/Settings/Version_Switch.php b/src/php/Settings/Version_Switch.php index e2588cfe4..786a14a4c 100644 --- a/src/php/Settings/Version_Switch.php +++ b/src/php/Settings/Version_Switch.php @@ -423,7 +423,7 @@ public static function render_version_switch_field(): void { * @return void */ public static function ajax_switch_version(): void { - check_ajax_referer( 'code_snippets_version_switch', sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) ) ); + check_ajax_referer( 'code_snippets_version_switch', 'nonce' ); if ( ! current_user_can( 'update_plugins' ) ) { wp_send_json_error( [ 'message' => __( 'You do not have permission to update plugins.', 'code-snippets' ) ] ); @@ -467,7 +467,7 @@ public static function render_refresh_versions_field(): void { * @return void */ public static function ajax_refresh_versions(): void { - check_ajax_referer( 'code_snippets_refresh_versions', sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) ) ); + check_ajax_referer( 'code_snippets_refresh_versions', 'nonce' ); if ( ! code_snippets()->current_user_can() ) { wp_send_json_error( [ 'message' => __( 'You do not have permission to manage options.', 'code-snippets' ) ] );