🐛 FIX: Unauthenticated attacker can update option

🐛 FIX: Unauthenticated attacker can update option value for "udp_agent_allow_tracking" via "init" hook due to missing authorization and nonce check in it's callback function "on_init".

Author: h1dd3nsn1p3r

includes/udp/class-udp-agent.php

@@ -172,6 +172,12 @@ public function show_settings_ui() {
 	 * @since    1.0.0
 	 */
 	private function process_user_tracking_choice() {
+		// Check if the user is logged in and has the capability to manage options.
+		if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
+			// Redirect to home page.
+			wp_safe_redirect( home_url() );
+			exit;
+		}
 
 		$users_choice = isset( $_GET['udp-agent-allow-access'] ) ? sanitize_text_field( wp_unslash( $_GET['udp-agent-allow-access'] ) ) : ''; //phpcs:ignore