Plugins kills AJAX requests by throwing 403

Hi there, We ran into an issue where all of a site’s AJAX requests by logged out users were resulting in 403 errors. After testing and investigating, it appeared to come from this Banner Management plugin. After a look at the code, it appears the issue is here: public function wcbm_send_wizard_data_after_plugin_activation() { $send_wizard_data = filter_input( INPUT_GET, 'send-wizard-data', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); if ( !current_user_can( 'manage_options' ) ) { wp_die( -1, 403 ); } if ( isset( $send_wizard_data ) && !empty( $send_wizard_data ) ) { ... } } This calls wp_die on any non-admin request, regardless of whether send-wizard-data is even present in the request. The capability gate should only apply when the wizard-data flow is actually being invoked: public function wcbm_send_wizard_data_after_plugin_activation() { $send_wizard_data = filter_input( INPUT_GET, 'send-wizard-data', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); if ( empty( $send_wizard_data ) ) { return; } if ( ! current_user_can( 'manage_options' ) ) { wp_die( -1, 403 ); } // ...existing wizard logic } Can you take a look to confirm? Thanks Just to add this, a quick way to test the issue is by opening a site as a logged out user, with the Banner plugin active, open the Browser console, and enter fetch('/wp-admin/admin-ajax.php?action=heartbeat').then(r => console.log(r.status)); This appears to throw a 403 admin-ajax.php forbidden error with the plugin active, but shows 200 success with the plugin inactive. Hi Stefanst, Thanks for reaching out. We’ve fixed the issue you reported and released it in version 2.5.3 . Please update the plugin to the latest version to make it work properly. Thank you, Hitendra | Dotstore Team