Changeset 3459337

Timestamp:

02/11/2026 08:45:48 PM (7 days ago)

Author:

SiteLockSecurity

Message:

Update trunk to 5.0.3

Location:

sitelock/trunk

Files:

• admin/class-sitelock-admin.php (modified) (2 diffs)
• changelog.txt (modified) (1 diff)
• includes/api/class-auth-manager.php (modified) (1 diff)
• readme.txt (modified) (5 diffs)
• sitelock.php (modified) (2 diffs)

sitelock/trunk/admin/class-sitelock-admin.php

@@ -1067 +1067 @@
 
 public function sitelock_scan_enqueue_scripts() {
+    // Prevents nonce leaking to unauthorized users by only enqueuing the script for users with manage_options capability
+    if (!current_user_can('manage_options')) {
+        return;
+    }
         
     wp_enqueue_script('sitelock-scan', plugin_dir_url(__FILE__) . 'js/sitelock-scan.js', ['jquery'], '1.0', true);
@@ -1079 +1083 @@
     check_ajax_referer('sitelock_scan_nonce', 'nonce');
 
+    if (!current_user_can('manage_options')) {
+        wp_send_json_error(['message' => 'Unauthorized'], 403);
+    }
+
     $scanType = isset($_POST['scan_type']) ? sanitize_text_field(wp_unslash($_POST['scan_type'])) : ''; // Default to 'patchman' if not provided
     $response = $this->api->sites->post_scan_now($scanType);

sitelock/trunk/changelog.txt

@@ -1 +1 @@
 == Changelog ==
+
+= 5.0.3 =
+_Release Date February 11, 2026_
+
+* Security: Improved admin permission checks for restricted functions
 
 = 5.0.2 =

sitelock/trunk/includes/api/class-auth-manager.php

@@ -136 +136 @@
     public function handle_auth($external_key = null)
     {
+        if (!current_user_can('manage_options')) {
+            wp_die(esc_html__('Unauthorized user.', 'sitelock-wordpress-plugin'), '', array('response' => 403));
+        }
+
         // Verify nonce
         if (!$external_key && (!isset($_POST['sitelock_license_key_nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['sitelock_license_key_nonce'])), 'sitelock_license_key_action'))) {

sitelock/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 6.9
 Requires PHP: 7.2
-Stable tag: 5.0.2
+Stable tag: 5.0.3
 Language: English
 License: GPLv2 or later
@@ -14 +14 @@
 == Description ==
 
->= 🌟 Completely Redesigned in Version 5.0 (November 2025) 🌟 =
+>**🌟 Completely Redesigned in Version 5.0 (November 2025) 🌟**
 >
 >This November marks a milestone: the SiteLock WordPress Plugin has been rebuilt with three goals: make it faster, make it clearer and move the heavy work to the cloud. We built a cloud-first architecture, modernized UI, expanded security controls and stripped out everything that didn't need to be there.
@@ -28 +28 @@
 >If you used the old plugin: this is a different tool. If you're new: you're starting with the cleanest, fastest version of the plugin.
 
+---
+
 Your website deserves protection that’s simple, fast and built for WordPress. SiteLock WordPress Security focuses on the everyday controls that matter most and helps you establish a secure baseline in minutes — WordPress-specific hardening, login protection and a clear Site Health dashboard that keeps you in control without slowing your site down.
 It’s lightweight, action-first protection that complements your host defenses: essential safeguards run inside WordPress while deeper checks happen securely in the SiteLock cloud. Skip heavy on-server scans and alert fatigue — run on-demand checks when you need extra assurance, so you can ship updates with confidence.
@@ -105 +107 @@
 - For broader topics explore the [SiteLock Help Center](https://www.sitelock.com/help-center/)
 
+= Security =
+Protecting our customers and systems is a top priority, and we take security very seriously. If you believe you’ve found a security vulnerability in the SiteLock WordPress plugin, please let us know at [email protected] before sharing any details publicly.
 
 == Frequently Asked Questions ==
@@ -184 +188 @@
 
 == Changelog ==
+
+= 5.0.3 =
+_Release Date February 11, 2026_
+
+* Security: Improved admin permission checks for restricted functions
 
 = 5.0.2 =

sitelock/trunk/sitelock.php

@@ -17 +17 @@
  * Plugin URI:        https://www.sitelock.com/wordpress
  * Description:       Free, lightweight WordPress security. WP Hardening, login protection and Site Health & on‑demand checks without slowing your site. Setup in minutes.
- * Version:           5.0.2
+ * Version:           5.0.3
  * Author:            SiteLockSecurity
  * Author URI:        https://www.sitelock.com
@@ -276 +276 @@
             .notice.notice-error {
                 max-width: 1115px; /* Set your desired max width */
+                margin: 10px 15px 0 10px; /* Set your desired margin */
             }
         </style>';