Cannot Approve Posts

Hi @daveparkhurst,

This is normal behavior for now when you enable “Prevent Zero-day Exploit” at “Admin area“.

Please think about the case that you receive a fake email which includes malicious link covered by a legitimate url. When you are logged in as an admin and carelessly click that malicious link in your email, your site would be contaminated with because you have admin credential.

This type of attack is called “Cross Site Request Forgeries” aka CSRF which is usually combined with other type of attacks such as XSS or SQLi.

If you think that this is inconvenient, please add the action approve into “Exceptions” at “Admin ajax/post“. I haven’t tested it, but it may be in effect.

Thanks for your kind understanding.