Published : July 20, 2026

CVE-2026-57721: ApplyOnline – Application Form Builder and Manager <= 2.6.7.6 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-57721
Plugin apply-online
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 2.6.7.6
Patched Version 2.6.8
Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57721:
This vulnerability is a Missing Authorization issue in the ApplyOnline – Application Form Builder and Manager plugin for WordPress, affecting versions up to and including 2.6.7.6. The vulnerability allows unauthenticated attackers to access application data or perform unauthorized actions via REST API endpoints that lack proper capability checks. The CVSS score is 5.3 (Medium severity).

The root cause is the addition of a new REST API class require statement in `class-applyonline.php` at line 142, which loads `class-applyonline-rest-functions.php`. The REST API initialization is registered in the `define_rest_hooks()` method at line 244 via `$this->loader->add_action( ‘rest_api_init’, $plugin_rest, ‘rest_api_init’)`. However, no capability checks (like `current_user_can()`) are applied to the REST API endpoints defined in the new REST functions file. The plugin does not verify user permissions before exposing sensitive data or actions through REST endpoints.

An attacker can exploit this by sending crafted HTTP requests to the WordPress REST API endpoints registered by the plugin. The specific endpoint paths would be under the plugin’s namespace (likely something like `applyonline/v1` or similar). An unauthenticated attacker can enumerate these endpoints by scanning the REST API index at `/wp-json/`. Once identified, they can trigger actions such as viewing submitted applications, modifying application statuses, or accessing admin-only functionality without any authentication.

The patch introduces the REST API initializer in `class-applyonline.php` but the diff shown does not include the actual REST functions file changes that would add permission checks. The fix would require adding `permission_callback` arguments to each REST route registration in `class-applyonline-rest-functions.php`, ensuring that only authorized users (e.g., those with `edit_posts` or `manage_options` capabilities) can access the endpoints.

Successful exploitation allows an unauthenticated attacker to view, modify, or delete job applications and their associated data (including applicant names, emails, file uploads, and custom form fields). This constitutes a significant data breach risk as application data often contains personally identifiable information (PII). Depending on the exposed endpoints, an attacker could also modify ad settings or application statuses.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/apply-online/admin/class-applyonline-admin.php
+++ b/apply-online/admin/class-applyonline-admin.php
@@ -117,7 +117,7 @@
 		 */
                 $localize = array();
                 $localize['app_submission_message'] = esc_html__('Form has been submitted successfully. If required, we will get back to you shortly!', 'apply-online');
-                $localize['app_closed_alert'] = esc_html__('We are no longer accepting applications for this ad!', 'apply-online');
+                $localize['app_closed_alert'] = esc_html__('The submission deadline for this ad has passed. Please contact support for more details.', 'apply-online');
                 $localize['aol_required_fields_notice'] = esc_html__('Fields with (*)  are compulsory.', 'apply-online');
                 $localize['admin_url'] = admin_url();
                 $localize['aol_url'] = plugins_url( 'apply-online/' );
@@ -417,7 +417,7 @@
                     <input type="time" placeholder="<?php esc_attr_e('Time in 24hour format', 'apply-online'); ?>" name="_aol_ad_closing_time" class="datetimepicker" value="<?php echo $time; ?>" />
                     <p><b><?php esc_html_e('Format', 'apply-online'); ?>:</b><i> dd-mm-yyyy</i><br/><b><?php esc_html_e('Example', 'WordPress'); ?>:</b> <i><?php echo current_time('j-m-Y'); ?></i><br/></p>
                     <p class="when-expires"><b><?php esc_html_e('When Expires', 'apply-online'); ?>:</b><br /> <label for="hide_form" style="display: inline-block"><input type="radio" id="hide_form" name="_aol_ad_close_type" value="form" <?php echo $close_form; ?> /><?php esc_html_e('Hide form only', 'apply-online'); ?></label><br />
-                    <label for="hide_ad" style="display: inline-block"><input type="radio" id="hide_ad" name="_aol_ad_close_type" value="ad" <?php echo $close_ad; ?> /><?php esc_html_e('Hide ad completely', 'apply-online'); ?></label></p>
+                    <label for="hide_ad" style="display: inline-block"><input type="radio" id="hide_ad" name="_aol_ad_close_type" value="ad" <?php echo $close_ad; ?> /><?php esc_html_e('Hide form & unlist ad', 'apply-online'); ?></label></p>
                 </div>
                 <?php do_action('aol_ad_close_before', $post); ?>
                 <div id="recipients" class="aol-tab-data wrap">
@@ -981,10 +981,10 @@
 	 * @access   public
 	 * @var      string    $plugin_name    The ID of this plugin.
 	 */
-        var $app_field_types;
+        //var $app_field_types; @todo: Replaced with app_field_types() function. Causing translation warning, Remove safely

         public function __construct() {
-            $this->app_field_types = $this->app_field_types();
+            //$this->app_field_types = $this->app_field_types(); @todo: Remove safely

             add_action( 'save_post', array($this, 'save_form_elements'),1 );

@@ -1401,8 +1401,9 @@
                         </tbody>
                 </table>
             </div>
-            <?php $this->application_fields_generator($this->app_field_types); ?>
             <?php
+            $field_types = $this->app_field_types();
+            $this->application_fields_generator( $field_types );
         }

         function ismd5($md5 ='') {
@@ -1747,9 +1748,9 @@

                     $message="Hi there,nn"
                         ."Thanks for showing interest in the ad: [title]. Your application with id [id] has been received. We will review your application and contact you if required.nn"
-                        .sprintf(__('Team %s'), get_bloginfo('name'))."n"
+                        .sprintf('Team %s', get_bloginfo('name'))."n"
                         .site_url()."n"
-                        ."Please do not reply to this system generated message.";
+                        ."Please do not reply to the system generated message.";
                     $depricated = sprintf(__('This section is being depricated and will be removed on %s. Please use similar section in each ad.', 'apply-online'), date('M d, Y'));
                 ?>
                     <!--
@@ -1775,18 +1776,18 @@
                     </tr>
                     -->
                     <tr>
-                        <th><label for="aol_name_column_field"><?= esc_html_e('Form field to show in Applications section', 'apply-online'); ?></label></th>
+                        <th><label for="aol_name_column_field"><?= esc_html_e('Form field for Applications table', 'apply-online'); ?></label></th>
                         <td>
                             <input id="aol_name_column_field" class="regular-text" name="aol_name_column_field" value="<?= esc_attr( get_option('aol_name_column_field') ); ?>" placeholder="name">
-                            <p class="description"><?= esc_html_e('Select a form field id from the form builder to show in the Applications table under Applicant column. Defaults to name field.', 'ApplyOnline'); ?></p>
+                            <p class="description"><?= esc_html_e('Select a form field id from the form builder to show in the Applications table under Applicant column. Defaults to name field.', 'apply-online'); ?></p>
                         </td>
                     </tr>
                     <tr>
                         <th><label for="aol_from_email"><?php esc_html_e('From email address', 'apply-online'); ?></label></th>
                         <td>
                             <input id="aol_from_email" class="regular-text" name="aol_from_email" value="<?= esc_attr( get_option('aol_from_email') ); ?>" placeholder="do-not-reply">
-                            <p class="description"><?php esc_html_e('Make sure this email address exist on your mailing server otherwise email delivery may fail.', 'apply-online'); ?></p>
-                            <p class="description"><?php esc_html_e('Mail SMTP plugin is important for email deliverability. Make sure you have installed & configured a Mail SMTP plugin correctly.'); ?>
+                            <p class="description"><?php esc_html_e('Make sure this email address exist on your mailing server and an SMTP plugin installed correctly otherwise email deliverability may fail.', 'apply-online'); ?></p>
+                            <p class="description"><?php //esc_html_e('Mail SMTP plugin is important for email deliverability. Make sure you have installed & configured a Mail SMTP plugin correctly.'); ?>
                         </td>
                     </tr>
                     <tr>
@@ -1866,7 +1867,7 @@
                     <tr>
                         <th><label for="app_closed_alert"><?php esc_html_e('Closed Application alert', 'apply-online'); ?></label></th>
                         <td>
-                            <textarea id="app_closed_alert" class="small-text code" name="aol_application_close_message" cols="50" rows="3"><?php echo sanitize_text_field( get_option_fixed('aol_application_close_message', __('We are no longer accepting applications for this ad.', 'apply-online')) ); ?></textarea>
+                            <textarea id="app_closed_alert" class="small-text code" name="aol_application_close_message" cols="50" rows="3"><?php echo sanitize_text_field( get_option_fixed('aol_application_close_message', __('The submission deadline for this ad has passed. Please contact support for more details.', 'apply-online')) ); ?></textarea>
                             <br />
                             <button id="app_closed_alert_button" class="button"><?php esc_html_e('Default Alert', 'apply-online'); ?></button>
                         </td>
--- a/apply-online/apply-online.php
+++ b/apply-online/apply-online.php
@@ -11,12 +11,12 @@
  * Plugin Name:       ApplyOnline
  * Plugin URI:        https://wpreloaded.com
  * Description:       Online Form Builder and Applications Manager.
- * Version:           2.6.7.6
+ * Version:           2.6.8
  * Author:            Farhan Noor
  * Author URI:        https://linkedin.com/in/farhan-noor
  * License:           GPL-2.0+
  * License URI:       http://www.gnu.org/licenses/gpl-2.0.txt
- * Text Domain:       ApplyOnline
+ * Text Domain:       apply-online
  * Domain Path:       /languages
  */

@@ -24,7 +24,7 @@
 if ( ! defined( 'WPINC' ) ) {
 	die;
 }
-define( 'APPLYONLINE_VERSION', '2.6.7.6' );
+define( 'APPLYONLINE_VERSION', '2.6.8' );

 require_once( 'class-addons-update.php' );
 /**
--- a/apply-online/includes/applyonline-functions.php
+++ b/apply-online/includes/applyonline-functions.php
@@ -63,7 +63,7 @@
  * @return string attributes
  */
 function get_aol_form_button($id = 'aol_app_submit_button', $title = NULL, $classes = NULL, $atts = array() ){
-    if( $title == NULL ) $title = esc_attr__('Submit', 'ApplyOnline');
+    if( $title == NULL ) $title = esc_attr__('Submit', 'apply-online');
     if( $classes == NULL ) $classes = apply_filters('aol_form_button_classes', 'btn btn-primary btn-submit button submit fusion-button button-large aol-form-button '. esc_attr( get_option('aol_submit_button_classes') ) );

     $attributes = apply_filters('aol_form_button_attributes', $atts);
@@ -162,7 +162,7 @@
  * Returns Ad types with relevent data.
  */
 function aol_ad_types(){
-    return get_option_fixed('aol_ad_types', array('ad' => array('singular' => esc_html__('Ad','ApplyOnline'), 'plural' => esc_html__('Ads','ApplyOnline'), 'description' => esc_html__('All Ads','ApplyOnline'), 'filters' => array())));
+    return get_option_fixed('aol_ad_types', array('ad' => array('singular' => esc_html__('Ad','apply-online'), 'plural' => esc_html__('Ads','apply-online'), 'description' => esc_html__('All Ads','apply-online'), 'filters' => array())));
 }

 /**
@@ -262,7 +262,7 @@
 }

 function aol_app_statuses(){
-    $filters = array('pending' => esc_html__('Pending', 'ApplyOnline'), 'rejected'=> esc_html__('Rejected', 'ApplyOnline'), 'shortlisted' => esc_html__('Shortlisted', 'ApplyOnline'));
+    $filters = array('pending' => esc_html__('Pending', 'apply-online'), 'rejected'=> esc_html__('Rejected', 'apply-online'), 'shortlisted' => esc_html__('Shortlisted', 'apply-online'));
     $statuses = array_merge($filters, get_option_fixed('aol_custom_statuses', array()));
     return apply_filters('aol_app_statuses', $statuses);
 }
@@ -305,8 +305,8 @@
             'aol_ad_types',
             array(
                 'ad' => array(
-                    'singular' => esc_html__('Ad','ApplyOnline'),
-                    'plural' => esc_html__('Ads','ApplyOnline'),
+                    'singular' => esc_html__('Ad','apply-online'),
+                    'plural' => esc_html__('Ads','apply-online'),
                     'filters' => array_keys( aol_ad_filters() )
                     )
                 )
@@ -364,8 +364,8 @@

 function aol_links_shortcode( $atts ) {
 	$a = shortcode_atts( array(
-            'href' => esc_html__('Link is missing', 'ApplyOnline'),
-            'title' => esc_html__('Title is missing', 'ApplyOnline'),
+            'href' => esc_html__('Link is missing', 'apply-online'),
+            'title' => esc_html__('Title is missing', 'apply-online'),
             'target' => '_blank',

 	), $atts );
@@ -393,7 +393,7 @@
     $form_output = NULL;
     foreach($fields as $field):
         //$value = isset($field['value']) ? $field['value'] : NULL;
-        $value = isset($field['val']) ? sanitize_textarea_field( $field['val'] ) : NULL;
+        $value = isset($field['val']) ? sanitize_textarea_field( $field['val'] ) : '';
         $placeholder   = isset($field['placeholder']) ? 'placeholder="'.sanitize_text_field( $field['placeholder'] ).'"' : NULL;
         $class         = isset($field['class']) ? esc_attr( $field['class'] ) : NULL;

@@ -434,7 +434,7 @@
                 break;

             case 'date':
-                $form_output .= $wrapper_start. '<input type="text" '.$placeholder.' name="'.$prepend.$field_key.'" class="form-control datepicker '.$class.'" id="'.$prepend.$field_key.'" value="'.$value.'"  placeholder="'.esc_attr__('e.g.', 'ApplyOnline').' '.current_time(get_option('date_format')).'" '.$attributes.'  aria-describedby="help'.$field_key.'" >'.$wrapper_end;
+                $form_output .= $wrapper_start. '<input type="text" '.$placeholder.' name="'.$prepend.$field_key.'" class="form-control datepicker '.$class.'" id="'.$prepend.$field_key.'" value="'.$value.'"  placeholder="'.esc_attr__('e.g.', 'apply-online').' '.current_time(get_option('date_format')).'" '.$attributes.'  aria-describedby="help'.$field_key.'" >'.$wrapper_end;
                 break;

             case 'dropdown':
@@ -476,13 +476,13 @@
                 $is_multi_steps = get_option('aol_multistep');
                 $hide_section = $back = $multistep_output = NULL;
                 if($is_multi_steps){
-                    if($fieldset > 1) $back = '<button class="aol_multistep btn btn-default btn-previous pull-left" data-load="back"><span class="dashicons dashicons-arrow-left-alt2"></span> '.esc_html__('Previous', 'ApplyOnline').'</button>';
+                    if($fieldset > 1) $back = '<button class="aol_multistep btn btn-default btn-previous pull-left" data-load="back"><span class="dashicons dashicons-arrow-left-alt2"></span> '.esc_html__('Previous', 'apply-online').'</button>';
                     if($fieldset > 0){
                         $hide_section   = 'style="display:none;"';
                     }
                 }

-                $multistep_output = $back.'<button class="aol_multistep btn btn-default btn-next pull-right" data-load="next">'.esc_html__('Next', 'ApplyOnline').' <span class="dashicons dashicons-arrow-right-alt2"></span></button>';
+                $multistep_output = $back.'<button class="aol_multistep btn btn-default btn-next pull-right" data-load="next">'.esc_html__('Next', 'apply-online').' <span class="dashicons dashicons-arrow-right-alt2"></span></button>';
                 if($fieldset > 0)   $form_output.=  $multistep_output.'</fieldset>';

                 $form_output.=  "<fieldset $hide_section><legend>".sanitize_text_field($label).'</legend>';
@@ -515,7 +515,7 @@
                 break;
         }
     endforeach;
-    //if($fieldset > 0) $form_output.=  '<button class="aol_multistep btn btn-default btn-previous pull-left '.get_option('aol_multistep_button_classes').'" data-load="back"><span class="dashicons dashicons-arrow-left-alt2"></span> '.esc_html__('Previous', 'ApplyOnline').'</button></fieldset>';
+    //if($fieldset > 0) $form_output.=  '<button class="aol_multistep btn btn-default btn-previous pull-left '.get_option('aol_multistep_button_classes').'" data-load="back"><span class="dashicons dashicons-arrow-left-alt2"></span> '.esc_html__('Previous', 'apply-online').'</button></fieldset>';
     if($fieldset == 1) $form_output .= '</fieldset>';

     return $form_output;//ob_get_clean();
@@ -565,14 +565,14 @@

             $val = get_post_meta ( $post->ID, $key, true );
             //Support to previuos versions where only URL was saved in the post meta.
-            //if ( !filter_var($val, FILTER_VALIDATE_URL) === false ) $val = '<a href="'.$val.'" target="_blank">'.esc_html__('View','ApplyOnline').'</a> | <a href="'.esc_url ($val).'" >'.esc_html__('Download','ApplyOnline').'</a>';
+            //if ( !filter_var($val, FILTER_VALIDATE_URL) === false ) $val = '<a href="'.$val.'" target="_blank">'.esc_html__('View','apply-online').'</a> | <a href="'.esc_url ($val).'" >'.esc_html__('Download','apply-online').'</a>';

             if(is_array($val)){
                 //If the outputs is file attachment
                 if(isset($val['file']) AND isset($val['type'])){
-                    $val = '<a href="'. aol_crypt($val['file']).'" target="_blank">'.esc_html__('Attachment','ApplyOnline').'</a>';
+                    $val = '<a href="'. aol_crypt($val['file']).'" target="_blank">'.esc_html__('Attachment','apply-online').'</a>';
                 } elseif(isset($val['url']) AND isset($val['type'])){
-                    $val = '<a href="'.esc_url($val['url']).'" target="_blank">"'.esc_html__('Attachment','ApplyOnline').'"</a>';
+                    $val = '<a href="'.esc_url($val['url']).'" target="_blank">"'.esc_html__('Attachment','apply-online').'"</a>';
                 }

                 //If output is a radio or checkbox.
@@ -641,9 +641,9 @@
                     echo '<td>' . sanitize_text_field($row['label']) . '</td>';
                     echo '<td>';
                     if(empty($row['value'])) {
-                        echo '<i class="text-secondary">- '.esc_html__('not provided', 'ApplyOnline').' -</i>';
+                        echo '<i class="text-secondary">- '.esc_html__('not provided', 'apply-online').' -</i>';
                     } else {
-                        echo ( $row['type'] == 'file' ) ? '<a href="'.esc_url(get_option('siteurl').'?aol_attachment='.$row['value'] ).'" target="_blank">'.esc_html__('Attachment','ApplyOnline').'</a>' : sanitize_textarea_field($row['value']);
+                        echo ( $row['type'] == 'file' ) ? '<a href="'.esc_url(get_option('siteurl').'?aol_attachment='.$row['value'] ).'" target="_blank">'.esc_html__('Attachment','apply-online').'</a>' : sanitize_textarea_field($row['value']);
                     }
                     echo '</td>';
                 echo '</tr>';
@@ -716,7 +716,7 @@
  * @return array Headers required by mail functions.
  */
 function aol_from_mail_header($extra_headers = array()){
-    $user = get_option( 'aol_from_email', 'do-not-reply' );
+    $user = get_option_fixed( 'aol_from_email', 'do-not-reply', TRUE );
     // Get the site domain and get rid of www.
     $sitename = strtolower( $_SERVER['SERVER_NAME'] );
     if ( substr( $sitename, 0, 4 ) == 'www.' ) {
@@ -724,17 +724,9 @@
     }
     $from_email = $user.'@'.$sitename;

-    //Removed since 2.5.4
-    //$headers = 'Content-Type: text/html'."rn";
-    //$headers .= wp_specialchars_decode('From: '.get_bloginfo('name')." <$from_email>")."rn";
-    //$headers .= implode(",rn", $extra_headers);
-
-    //Introduced in  2.5.4
     $headers = array('Content-Type: text/html', "From: ". wp_specialchars_decode( get_bloginfo('name') )." <$from_email>");

     return array_merge($headers, $extra_headers);
-
-    //return array('Content-Type: text/html', "From:". wp_specialchars_decode(get_bloginfo('name'))." <$from_email>", implode(',', $extra_headers));
 }

 /**
@@ -764,13 +756,14 @@
 }

 function aol_mail_footer(){
-        $message  = "nn";
-        $message  .= "Thank you";
-        $message .= "n";
-        $message .= get_bloginfo('name')."n";
-        $message .= site_url()."n";
-        $message .= "------n";
-        $message .= "Please do not reply to this system generated message.";
+        //$message .= '<p>'.sprintf(__('Thank you,<br>Team %s'), get_option('blogname')).'</p>';
+        $message  = '<p>';
+        $message .= __('Thank you,').'<br>';
+        $message .= get_bloginfo('name').'<br>';
+        $message .= site_url().'<br>';
+        $message .= '------<br>';
+        $message .= '</p>';
+        $message .= '<i>Please do not reply to the system generated message.</i>';
     return $message;
 }

--- a/apply-online/includes/class-applyonline-activator.php
+++ b/apply-online/includes/class-applyonline-activator.php
@@ -39,9 +39,9 @@
             //Registering taxonomies (Ad Filters) to work at activation.
             //$filters = aol_ad_filters();
             $filters = array(
-                'category' => array('singular' => __('Category', 'ApplyOnline'), 'plural' => __('Categories', 'ApplyOnline')),
-                'type' => array('singular' => __('Type', 'ApplyOnline'), 'plural' => __('Types', 'ApplyOnline')),
-                'location' => array('singular' => esc_html__('Location', 'ApplyOnline'), 'plural' => esc_html__('Locations', 'ApplyOnline'))
+                'category' => array('singular' => __('Category', 'apply-online'), 'plural' => __('Categories', 'apply-online')),
+                'type' => array('singular' => __('Type', 'apply-online'), 'plural' => __('Types', 'apply-online')),
+                'location' => array('singular' => esc_html__('Location', 'apply-online'), 'plural' => esc_html__('Locations', 'apply-online'))
             );

             foreach($filters as $key => $filter){
@@ -276,9 +276,9 @@
             if(!get_option('aol_ad_types')) update_option('aol_ad_types', $types);

             $default_filters = array(
-                'category' => array('singular' => __('Category', 'ApplyOnline'), 'plural' => __('Categories', 'ApplyOnline')),
-                'type' => array('singular' => __('Type', 'ApplyOnline'), 'plural' => __('Types', 'ApplyOnline')),
-                'location' => array('singular' => esc_html__('Location', 'ApplyOnline'), 'plural' => esc_html__('Locations', 'ApplyOnline'))
+                'category' => array('singular' => __('Category', 'apply-online'), 'plural' => __('Categories', 'apply-online')),
+                'type' => array('singular' => __('Type', 'apply-online'), 'plural' => __('Types', 'apply-online')),
+                'location' => array('singular' => esc_html__('Location', 'apply-online'), 'plural' => esc_html__('Locations', 'apply-online'))
             );
             if(!get_option('aol_ad_filters')) update_option('aol_ad_filters', $default_filters);

@@ -303,12 +303,12 @@
             if(!get_option('aol_app_statuses')) update_option('aol_app_statuses', array('pending', 'rejected', 'shortlisted'));
             if(!get_option('aol_show_filter')) update_option('aol_show_filter', 0);
             //if(!get_option('aol_ad_filters')) update_option('aol_ad_filters', array('category', 'type', 'location'));
-            if(!get_option('aol_application_close_message')) update_option('aol_application_close_message', 'We are no longer accepting applications for this ad. Contact us for more details.');
-            if(!get_option('aol_mail_footer')) update_option('aol_mail_footer', "nnThank youn".get_bloginfo('name')."n".site_url()."n------nPlease do not reply to this system generated message.");
-            if(!get_option('aol_custom_statuses')) update_option('aol_custom_statuses', array('pending' => __('Pending', 'ApplyOnline'), 'rejected'=> __('Rejected', 'ApplyOnline'), 'shortlisted' => __('Shortlisted', 'ApplyOnline')));
+            if(!get_option('aol_application_close_message')) update_option('aol_application_close_message', 'The submission deadline for this ad has passed. Please contact support for more details.');
+            if(!get_option('aol_mail_footer')) update_option('aol_mail_footer', "nnThank youn".get_bloginfo('name')."n".site_url()."n------nPlease do not reply to the system generated message.");
+            if(!get_option('aol_custom_statuses')) update_option('aol_custom_statuses', array('pending' => __('Pending', 'apply-online'), 'rejected'=> __('Rejected', 'apply-online'), 'shortlisted' => __('Shortlisted', 'apply-online')));
             if(!get_option('aol_nonce_is_active', 1)) update_option('aol_nonce_is_active', 1);
             if(!get_option('aol_success_mail_message')) update_option('aol_success_mail_message', "Hi there,nnThank you for showing interest in the ad: [title]. Your application with id [id] has been received. We will review your application and contact you if required.nn"
-                        .sprintf(__('Team %s'), get_bloginfo('name'))."n"
+                        .sprintf('Team %s', get_bloginfo('name'))."n"
                         .site_url()."n"
                         ."Please do not reply to this system generated message.");
             if(!get_option('aol_success_mail_subject')) update_option('aol_success_mail_subject', 'Your application for [title]');
--- a/apply-online/includes/class-applyonline-updater.php
+++ b/apply-online/includes/class-applyonline-updater.php
@@ -94,9 +94,9 @@

         function fix_filters(){
                $default_filters = [
-                    'category' => array('singular' => esc_html__('Category', 'ApplyOnline'), 'plural' => esc_html__('Categories', 'ApplyOnline')),
-                    'type' => array('singular' => esc_html__('Type', 'ApplyOnline'), 'plural' => esc_html__('Types', 'ApplyOnline')),
-                    'location' => array('singular' => esc_html__('Location', 'ApplyOnline'), 'plural' => esc_html__('Locations', 'ApplyOnline'))
+                    'category' => array('singular' => esc_html__('Category', 'apply-online'), 'plural' => esc_html__('Categories', 'apply-online')),
+                    'type' => array('singular' => esc_html__('Type', 'apply-online'), 'plural' => esc_html__('Types', 'apply-online')),
+                    'location' => array('singular' => esc_html__('Location', 'apply-online'), 'plural' => esc_html__('Locations', 'apply-online'))
                 ];
                 $custom_filters = get_option_fixed('aol_custom_filters', array());
                 $filters = array_merge($default_filters, $custom_filters);
@@ -105,14 +105,14 @@
                 update_option('aol_ad_filters', $filters);

                 /*Merge Custom Statuses to Default Statuses*/
-                $default_statuses = array('pending' => __('Pending', 'ApplyOnline'), 'rejected'=> __('Rejected', 'ApplyOnline'), 'shortlisted' => __('Shortlisted', 'ApplyOnline'));
+                $default_statuses = array('pending' => __('Pending', 'apply-online'), 'rejected'=> __('Rejected', 'apply-online'), 'shortlisted' => __('Shortlisted', 'apply-online'));
                 $custom_statuses = get_option_fixed('aol_custom_statuses', array());
                 $statuses = array_merge($default_statuses, $custom_statuses);
                 //Update Option was not working for Existing options, hence it is 1st being deleted.
                 delete_option('aol_custom_statuses');
                 update_option('aol_custom_statuses', $statuses);

-                //update_option('aol_mail_footer', "nnThank youn".get_bloginfo('name')."n".site_url()."n------nPlease do not reply to this system generated message.");
+                //update_option('aol_mail_footer', "nnThank youn".get_bloginfo('name')."n".site_url()."n------nPlease do not reply to the system generated message.");
         }

         function fix_application_statuses(){
--- a/apply-online/includes/class-applyonline.php
+++ b/apply-online/includes/class-applyonline.php
@@ -139,15 +139,8 @@
 		 * The class responsible for defining all actions that occur in the REST API
 		 */
 		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'rest/class-applyonline-rest.php';
+		require_once plugin_dir_path( dirname( __FILE__ ) ) . 'rest/class-applyonline-rest-functions.php';

-                /*
-                 * Form Builder addon
-                 */
-                //require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/builder/class-functions.php';
-                //require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/builder/class-init.php';
-
-                //require_once plugin_dir_path( dirname( __FILE__ ) ) . 'required-plugins/class-tgm-plugin-activation.php';
-
 		$this->loader = new Applyonline_Loader();

 	}
@@ -164,9 +157,9 @@
 	private function set_locale() {

 		$plugin_i18n = new Applyonline_i18n();
-		$plugin_i18n->set_domain( 'ApplyOnline' );
+		$plugin_i18n->set_domain( 'apply-online' );

-		$this->loader->add_action( 'plugins_loaded', $plugin_i18n, 'load_plugin_textdomain' );
+		$this->loader->add_action( 'init', $plugin_i18n, 'load_plugin_textdomain' );

 	}

@@ -219,7 +212,7 @@

 		$this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_styles', 1 );
 		$this->loader->add_action( 'wp_enqueue_scripts', $plugin_public, 'enqueue_scripts' );
-
+
                 /*Schedule Ad*/
                 $this->loader->add_action( 'pre_get_posts', $plugin_public, 'check_ad_closing_status' );
                 $this->loader->add_action( 'set_current_user', $plugin_public, 'output_attachment' );
@@ -248,9 +241,10 @@
 	 */
 	private function define_rest_hooks() {

-		$rest_public = new Applyonline_Rest( $this->get_plugin_name(), $this->get_version() );
+		$plugin_rest = new Applyonline_Rest( $this->get_plugin_name(), $this->get_version() );

-		//$this->loader->add_action( 'wp_enqueue_scripts', $rest_public, 'enqueue_styles', 1 );
+                $this->loader->add_action( 'rest_api_init', $plugin_rest, 'rest_api_init');
+                //$this->loader->add_filter( 'aol_form_errors', $plugin_rest, 'file_uploader', 10,3 ); //Call file_uploader when form is being processed.
 	}

         /**
--- a/apply-online/languages/apply-online-de_DE.l10n.php
+++ b/apply-online/languages/apply-online-de_DE.l10n.php
@@ -0,0 +1,2 @@
+<?php
+return ['project-id-version'=>'Apply Online','report-msgid-bugs-to'=>'','pot-creation-date'=>'2026-02-03 05:44+0000','po-revision-date'=>'2026-02-03 06:55+0000','last-translator'=>'','language-team'=>'German','language'=>'de_DE','plural-forms'=>'nplurals=2; plural=n != 1;','mime-version'=>'1.0','content-type'=>'text/plain; charset=UTF-8','content-transfer-encoding'=>'8bit','x-generator'=>'Loco https://localise.biz/','x-loco-version'=>'2.8.1; wp-6.9; php-8.2.12','messages'=>['%s is invalid.'=>'%s ist ungültig.','%s is oversized. Must be under %s MB'=>'%s ist zu groß. Es darf nicht größer als %s MB sein.','%s is required.'=>'%s ist erforderlich.','%sClick Here%s to access this application.'=>'%sHier klicken%s um auf diese Anwendung zuzugreifen.','A new application for the ad %1$s received on %2$s website.'=>'Eine neue Bewerbung für die Anzeige %1$s ist auf der Website %2$s eingegangen.','Ad'=>'Annonce','Ads'=>'Anzeigen','All Ads'=>'Alle Anzeigen','ApplyOnline'=>'ApplyOnline','Attachment'=>'Befestigung','Categories'=>'Kategorien','Category'=>'Kategorie','Check Box'=>'Kontrollkästchen','Drop Down'=>'Dropdown','e.g.'=>' z.B.','Farhan Noor'=>'Farhan Noor','File'=>'Datei','Filter'=>'Filter','Form has been submitted successfully with application id [id]. If required, we will get back to you shortly!'=>'Das Formular wurde erfolgreich mit der Antrags-ID [id] übermittelt. Bei Bedarf melden wir uns in Kürze bei Ihnen!','Form ID is missing'=>'Die Formular-ID fehlt.','Hi,'=>'Hallo,','https://linkedin.com/in/farhan-noor'=>'https://linkedin.com/in/farhan-noor','https://wpreloaded.com'=>'https://wpreloaded.com','If the application does not load after a few seconds, please try the following:'=>'Falls die Anwendung nach einigen Sekunden nicht lädt, versuchen Sie bitte Folgendes:','Invalid file %1$s. Allowed file types are: %2$s'=>'Ungültige Datei %1$s. Zulässige Dateitypen sind: %2$s','Link is missing'=>'Link fehlt','Location'=>'Standort','Locations'=>'Standorte','Missing required fields'=>'Fehlende Pflichtfelder','not provided'=>'nicht angegeben','Online Form Builder and Applications Manager.'=>'Online-Formulargenerator und Anwendungsmanager.','Open the application in a new tab.'=>'Öffnen Sie die Anwendung in einem neuen Tab.','Pending'=>'Ausstehend','publicApply Online'=>'Online bewerben','Radio'=>'Optionsfeld','Read More'=>'Mehr lesen','Rejected'=>'Abgelehnt','Report this problem to the development team.'=>'Melden Sie dieses Problem dem Entwicklerteam.','Search Keyword'=>'Suchbegriff','Separator'=>'Separator','Session Expired, please refresh this page and try again. If problem persists, please report this issue through Contact Us page. Thanks'=>'Ihre Sitzung ist abgelaufen. Bitte aktualisieren Sie die Seite und versuchen Sie es erneut. Sollte das Problem weiterhin bestehen, melden Sie es bitte über unsere Kontaktseite. Vielen Dank.','Shortlisted'=>'in die engere Wahl gezogen','Submit'=>'Einreichen','Text'=>'Text','Thank you'=>'Danke','This is an automated response from Apply Online plugin on %s'=>'Dies ist eine automatische Antwort des Apply Online-Plugins auf %s.','Title is missing'=>'Der Titel fehlt.','Try switching to a more stable network connection.'=>'Versuchen Sie, auf eine stabilere Netzwerkverbindung umzuschalten.','Try using a different browser.'=>'Versuchen Sie es mit einem anderen Browser.','Type'=>'Typ','Types'=>'Typen','We are no longer accepting applications for this ad.'=>'Wir nehmen keine Bewerbungen mehr für diese Anzeige entgegen.']];
--- a/apply-online/languages/apply-online-es_ES.l10n.php
+++ b/apply-online/languages/apply-online-es_ES.l10n.php
@@ -0,0 +1,2 @@
+<?php
+return ['project-id-version'=>'Apply Online','report-msgid-bugs-to'=>'','pot-creation-date'=>'2026-02-03 05:44+0000','po-revision-date'=>'2026-02-03 07:01+0000','last-translator'=>'','language-team'=>'Spanish (Spain)','language'=>'es_ES','plural-forms'=>'nplurals=2; plural=n != 1;','mime-version'=>'1.0','content-type'=>'text/plain; charset=UTF-8','content-transfer-encoding'=>'8bit','x-generator'=>'Loco https://localise.biz/','x-loco-version'=>'2.8.1; wp-6.9; php-8.2.12','messages'=>[]];
--- a/apply-online/languages/apply-online-fr_FR.l10n.php
+++ b/apply-online/languages/apply-online-fr_FR.l10n.php
@@ -0,0 +1,2 @@
+<?php
+return ['project-id-version'=>'Apply Online','report-msgid-bugs-to'=>'','pot-creation-date'=>'2020-07-18 08:08+0000','po-revision-date'=>'2026-02-03 06:25+0000','language-team'=>'French (France)','plural-forms'=>'nplurals=2; plural=(n > 1);','mime-version'=>'1.0','content-type'=>'text/plain; charset=UTF-8','content-transfer-encoding'=>'8bit','x-generator'=>'Loco https://localise.biz/','x-loco-version'=>'2.8.1; wp-6.9; php-8.2.12','last-translator'=>'','language'=>'fr_FR','messages'=>['%s is invalid.'=>'%s est invalide.','%s is oversized. Must be under %s MB'=>'%s est trop lourd. Il doit être en dessous de  %s MB','%s is required.'=>'%s est requis.','%sClick Here%s to access this application.'=>'%sCliquez ici%s pour accéder à cette candidature.','A new application for the ad %1$s received on %2$s website.'=>'Une nouvelle demande pour l'annonce %1$s reçue sur le site web %2$s.','Ad'=>'Annonce','Ads'=>'Appels','All Ads'=>'Les appels','ApplyOnline'=>'E-Candidature','Attachment'=>'Pièce jointe','Categories'=>'Catégories','Category'=>'Catégorie','Check Box'=>'case à cocher','Drop Down'=>'Dérouler','e.g.'=>'ex.','Farhan Noor'=>'Farhan Noor','File'=>'Fichier','Filter'=>'Filtre','Form has been submitted successfully with application id [id]. If required, we will get back to you shortly!'=>'Le formulaire a été soumis avec succès avec l'id de candidature %d. Nous vous contacterons prochainement!','Form ID is missing'=>'L'identifiant du formulaire est manquant','Hi,'=>'Salut,','https://linkedin.com/in/farhan-noor'=>'https://linkedin.com/in/farhan-noor','https://wpreloaded.com'=>'https://wpreloaded.com','If the application does not load after a few seconds, please try the following:'=>'Si l'application ne se charge pas après quelques secondes, veuillez essayer ce qui suit :','Invalid file %1$s. Allowed file types are: %2$s'=>'Fichier invalide %s. Les fichiers autorisés sont %s','Link is missing'=>'Lien manquant','Location'=>'Lieu','Locations'=>'Lieux','Missing required fields'=>'Champs obligatoires manquants','not provided'=>'non fourni','Online Form Builder and Applications Manager.'=>'Créateur de formulaires en ligne et gestionnaire d'applications.','Open the application in a new tab.'=>'Ouvrez l'application dans un nouvel onglet.','Pending'=>'En attente','publicApply Online'=>'Candidature en ligne','Radio'=>'Bouton radio','Read More'=>'En savoir plus','Rejected'=>'Rejeté','Report this problem to the development team.'=>'Signalez ce problème à l'équipe de développement.','Search Keyword'=>'Mot-clé de recherche','Separator'=>'Séparateur','Session Expired, please refresh this page and try again. If problem persists, please report this issue through Contact Us page. Thanks'=>'Session expirée. Veuillez actualiser la page et réessayer. Si le problème persiste, veuillez le signaler via la page « Nous contacter ». Merci.','Shortlisted'=>'Présélectionné','Submit'=>'Soumettre','Text'=>'Texte','Thank you'=>'Merci','This is an automated response from Apply Online plugin on %s'=>'Il s'agit d'une réponse automatisée - %s','Title is missing'=>'Titre manquant','Try switching to a more stable network connection.'=>'Essayez de passer à une connexion réseau plus stable.','Try using a different browser.'=>'Essayez d'utiliser un autre navigateur.','Type'=>'Type','Types'=>'Les types','We are no longer accepting applications for this ad.'=>'Nous n'acceptons plus les candidatures pour cet appel.']];
--- a/apply-online/languages/apply-online-nl_NL.l10n.php
+++ b/apply-online/languages/apply-online-nl_NL.l10n.php
@@ -0,0 +1,2 @@
+<?php
+return ['project-id-version'=>'Apply Online','report-msgid-bugs-to'=>'','pot-creation-date'=>'2020-02-20 15:24+0000','po-revision-date'=>'2026-02-03 06:25+0000','last-translator'=>'admin <rizwan4317@gmail.com>','language-team'=>'Dutch','language'=>'nl_NL','plural-forms'=>'nplurals=2; plural=n != 1;','mime-version'=>'1.0','content-type'=>'text/plain; charset=UTF-8','content-transfer-encoding'=>'8bit','x-generator'=>'Loco https://localise.biz/','x-loco-version'=>'2.3.1; wp-5.2.5','messages'=>[]];
--- a/apply-online/public/class-applyonline-public.php
+++ b/apply-online/public/class-applyonline-public.php
@@ -53,7 +53,7 @@

                 new AOL_Single_Post_Template($plugin_name, $version); //Passing 2 parameters to the child
                 new Applyonline_Shortcodes();
-                new Applyonline_AjaxHandler();
+                //new Applyonline_AjaxHandler(); Depricated
 	}

 	/**
@@ -107,7 +107,7 @@
                         'nonce'  => wp_create_nonce('wp_rest'),
                         'date_format'   => get_option('aol_date_format', 'dd-mm-yy'),
                         'url'    => plugins_url('', __DIR__),
-                        'consent_text' => get_option('aol_form_consent', FALSE),//esc_html__('Do you really want to submit this form?', 'ApplyOnline'),
+                        'consent_text' => get_option('aol_form_consent', FALSE),//esc_html__('Do you really want to submit this form?', 'apply-online'),
                 );
                 wp_localize_script (
                     $this->plugin_name,
@@ -196,12 +196,12 @@
             }

             $field_types = array(
-                'text'=> esc_html__('Text','ApplyOnline'),
-                'checkbox'=>esc_html__('Check Box','ApplyOnline'),
-                'dropdown'=>esc_html__('Drop Down','ApplyOnline'),
-                'radio'=> esc_html__('Radio','ApplyOnline'),
-                'file'=> esc_html__('File','ApplyOnline'),
-                'separator' => esc_html__('Seprator','ApplyOnline')
+                'text'=> esc_html__('Text','apply-online'),
+                'checkbox'=>esc_html__('Check Box','apply-online'),
+                'dropdown'=>esc_html__('Drop Down','apply-online'),
+                'radio'=> esc_html__('Radio','apply-online'),
+                'file'=> esc_html__('File','apply-online'),
+                'separator' => esc_html__('Separator','apply-online')
                 );

             $raw_fields = get_aol_ad_post_meta($post_id);
@@ -221,7 +221,7 @@
         public function application_form($post_id = 0){

             if(empty($post_id) AND !is_singular()){
-                return '<p id="aol_form_status alert alert-danger">'.esc_html__('Form ID is missing', 'ApplyOnline').'</p>';
+                return '<p id="aol_form_status alert alert-danger">'.esc_html__('Form ID is missing', 'apply-online').'</p>';
             }

             global $post;
@@ -237,10 +237,9 @@
             $progress_bar = get_option('aol_progress_bar_color', array('foreground' => '#222222', 'background' => '#dddddd', 'counter' => '#888888'));
             ob_start();

-            echo '<h3 class="aol-heading">'. esc_html_x('Apply Online', 'public', 'ApplyOnline').'</h3>';
             //If closing date has passed away.
             if( !empty($date) AND $date < time() )
-                return '<span class="alert alert-warning">'. get_option_fixed('aol_application_close_message', esc_html__('We are no longer accepting applications for this ad.', 'ApplyOnline')).'</span>';
+                return '<div class="alert alert-info">'. get_option_fixed('aol_application_close_message', esc_html__('The submission deadline for this ad has passed. Please contact support for more details.', 'apply-online')).'</div>';
                 $css_pattern = '/^#([0-9A-Fa-f]{3}){1,2}$/';
                 $css_bg = preg_match($css_pattern, $progress_bar['background']) ? $progress_bar['background'] : NULL;
                 $css_fg = preg_match($css_pattern, $progress_bar['foreground']) ? $progress_bar['foreground'] : NULL;
@@ -253,12 +252,13 @@
             </style>
             <form class="aol_app_form aol_app_form_<?php echo (int)$post_id; ?>" name="aol_app_form" id="aol_app_form" enctype="multipart/form-data"  data-toggle="validator" action="#aol_app_form">
                 <?php
+                    echo '<h3 class="aol-heading">'. esc_html_x('Apply Online', 'public', 'apply-online').'</h3>';
                     do_action('aol_before_form_fields', $post_id);

                     //Function returns sanitized data.
                     echo aol_form_generator($fields, 0, '_aol_app_', $post_id);
                     do_action('aol_after_form_fields', $post_id);
-                    $aol_button_attributes = apply_filters('aol_form_button_attributes', array('value' => esc_html__('Submit', 'ApplyOnline'), 'class' => 'btn btn-primary btn-submit button submit fusion-button button-large aol-form-button '. get_option('aol_submit_button_classes')));
+                    $aol_button_attributes = apply_filters('aol_form_button_attributes', array('value' => esc_html__('Submit', 'apply-online'), 'class' => 'btn btn-primary btn-submit button submit fusion-button button-large aol-form-button '. get_option('aol_submit_button_classes')));
                     $aol_button_attributes = apply_filters('aol_form_button', $aol_button_attributes);//depricated in the favour of aol_form_button_attributes since 2.2.3.1
                     $attributes = NULL;
                     foreach($aol_button_attributes as $key => $val){
@@ -340,7 +340,7 @@

         public function aol_the_content($content){
             global $post;
-            $types = get_option_fixed('aol_ad_types', array('ad' => array('singular'=> esc_html__('Ad','ApplyOnline'), 'plural' => esc_html__('Ads','ApplyOnline'))));
+            $types = get_option_fixed('aol_ad_types', array('ad' => array('singular'=> esc_html__('Ad','apply-online'), 'plural' => esc_html__('Ads','apply-online'))));
             $aol_types = array();
             foreach($types as $type => $val){
                 $aol_types[] = 'aol_'.$type;
@@ -352,11 +352,11 @@
             $title_features = empty($features) ? NULL : '<h4 class="aol-heading-features">'. get_option( 'aol_features_title', 'Salient Features' ).'</h4>';
             $form = $this->application_form();

-            $not_working = '<ul><li>'.esc_html__('If the application does not load after a few seconds, please try the following:', 'ApplyOnline').'</li>';
-            $not_working .= '<li>'.esc_html__('Open the application in a new tab. ', 'ApplyOnline').'</li>';
-            $not_working .= '<li>'.esc_html__('Try using a different browser. ', 'ApplyOnline').'</li>';
-            $not_working .= '<li>'.esc_html__('Try switching to a more stable network connection. ', 'ApplyOnline').'</li>';
-            $not_working .= '<li>'.esc_html__('Report this problem to the development team. ', 'ApplyOnline').'</li></ul>';
+            $not_working = '<ul><li>'.esc_html__('If the application does not load after a few seconds, please try the following:', 'apply-online').'</li>';
+            $not_working .= '<li>'.esc_html__('Open the application in a new tab.', 'apply-online').'</li>';
+            $not_working .= '<li>'.esc_html__('Try using a different browser.', 'apply-online').'</li>';
+            $not_working .= '<li>'.esc_html__('Try switching to a more stable network connection.', 'apply-online').'</li>';
+            $not_working .= '<li>'.esc_html__('Report this problem to the development team.', 'apply-online').'</li></ul>';

             //Show this content if you are viewing aol_ad post type using single.php (not with single-aol_type.php)
             $aol_content;
@@ -461,7 +461,7 @@
                                 $key = sanitize_key($key);
                                 //$Fclass = ((isset($_REQUEST['filter']) AND $_REQUEST['filter']) == 'aol_ad_'. $key) ? 'selected' : NULL;
                                 echo '<div class="aol-md-'.(int)$col_count.'">';
-                                    echo '<select name="'.esc_attr($key).'" class="aol-filter-select form-control"><option value="">'. sprintf(esc_html__('%s - All', 'Filter Dropdown', 'ApplyOnline'), esc_html__($filter['plural'], 'ApplyOnline') ).'</option>';
+                                    echo '<select name="'.esc_attr($key).'" class="aol-filter-select form-control"><option value="">'. sprintf(esc_html__('%s - All', 'Filter Dropdown', 'apply-online'), esc_html__($filter['plural'], 'apply-online') ).'</option>';
                                     $args = array(
                                         'taxonomy' => 'aol_ad_'. $key,
                                         'hide_empty' => true,
@@ -477,8 +477,8 @@
                             }
                             echo '</div>'; //Ended 1st row
                         echo '<div class="form-group">'; //2nd row started
-                        echo '<div class="aol-md-10"><input type="text" name="aol_seach_keyword" class="form-control" placeholder="'.esc_html__('Search Keyword', 'ApplyOnline').'" value="'. esc_attr($search_keyword).'"></div>';
-                        echo '<div class="aol-md-2"><button class="fusion-button button btn btn-info btn-block aol-filter-button">'.esc_html__('Filter', 'ApplyOnline').'</button></div>';
+                        echo '<div class="aol-md-10"><input type="text" name="aol_seach_keyword" class="form-control" placeholder="'.esc_html__('Search Keyword', 'apply-online').'" value="'. esc_attr($search_keyword).'"></div>';
+                        echo '<div class="aol-md-2"><button class="fusion-button button btn btn-info btn-block aol-filter-button">'.esc_html__('Filter', 'apply-online').'</button></div>';
                         echo '</div></form>'; //2nd row closed, form closed
                     echo '</div>'; //Ended Well
             }
@@ -530,7 +530,7 @@
                                                     '<a href="%s" ><button class="%s">%s</button></a>',
                                                     get_the_permalink($post),
                                                     'fusion-button button read-more btn btn-info',
-                                                    get_option( 'aol_readmore_button', __('Read More', 'ApplyOnline') )
+                                                    get_option( 'aol_readmore_button', __('Read More', 'apply-online') )
                                                     )
                                             );
                                         $body = apply_filters('aol_shortcode_body', $body, $post);
@@ -621,10 +621,10 @@
                     $pad = empty($tax) ? NULL : '  ';
                     $taxObj = get_taxonomy($term->taxonomy);
                     $span = is_null($tax) ? '<span class="aol-tax-wrapper">' : '</span><span class="aol-tax-wrapper">';
-                    $title = $span.$pad.'<strong class="aol-ad-taxonomy">'.esc_html__($taxObj->label, 'ApplyOnline').': </strong>';
+                    $title = $span.$pad.'<strong class="aol-ad-taxonomy">'.esc_html__($taxObj->label, 'apply-online').': </strong>';
                 }
                 $output.= $title.$term->name.$separator;
-                $tax = esc_html__($term->taxonomy, 'ApplyOnline');
+                $tax = esc_html__($term->taxonomy, 'apply-online');
             }
             $output.= '</span>';
             do_action('aol_shortcode_after_terms', $post_id);
@@ -691,8 +691,9 @@

 /**
   * This class is responsible to handle Ajax requests.
+  * Depricated in favor of class Applyonline_Rest.
   *
-  *
+  * @todo:
   * @since      1.0
   * @package    AjaxHandler
   * @author     Farhan Noor
@@ -759,14 +760,14 @@
                 $max_upload_size = $upload_size*1048576; //Multiply by KBs

                 if($max_upload_size < $val['size']){
-                        $errors->add('max_size', sprintf(esc_html__( '%s is oversized. Must be under %s MB', 'ApplyOnline' ), $val['name'] , $upload_size));
+                        $errors->add('max_size', sprintf(esc_html__( '%s is oversized. Must be under %s MB', 'apply-online' ), $val['name'] , $upload_size));
                 }

                 /* Check File Size */
                 $file_type_match = 0;
                 $filetype = wp_check_filetype(  $val['name'] );
                 $file_ext = strtolower($filetype['ext']);
-                if( !in_array($file_ext, $allowed_types) ) $errors->add('file_type', sprintf(esc_html__( 'Invalid file %1$s. Allowed file types are: %2$s', 'ApplyOnline' ), $val['name'], implode (',', $allowed_types)));
+                if( !in_array($file_ext, $allowed_types) ) $errors->add('file_type', sprintf(esc_html__( 'Invalid file %1$s. Allowed file types are: %2$s', 'apply-online' ), $val['name'], implode (',', $allowed_types)));
                 $errors = apply_filters('aol_before_file_upload_errors', $errors);
                 if(empty($errors->errors)){
                     do_action('aol_before_file_upload', $key, $val, $post);
@@ -799,7 +800,7 @@

             $nonce = $form_data['wp_nonce'];
             if( !wp_verify_nonce($nonce, 'the_best_aol_ad_security_nonce') /*and (int)get_option('aol_nonce_is_active', 1) == 1*/ ){
-                $response = array( 'code' => 'session_expired', 'reason' => 'Session Expired', 'message' => esc_html__( 'Session Expired, please refresh this page and try again. If problem presists, please report this issue through Contact Us page. Thanks', 'ApplyOnline' ) );
+                $response = array( 'code' => 'session_expired', 'reason' => 'Session Expired', 'message' => esc_html__( 'Session Expired, please refresh this page and try again. If problem persists, please report this issue through Contact Us page. Thanks', 'apply-online' ) );
                 $this->response($response, 401);
             }
             //Get parent ad value for which the application is being submitted.
@@ -838,19 +839,19 @@

                     //eMail validation.
                     if($val['type'] == 'email'){
-                        if(!empty($form_data[$key]) and is_email($form_data[$key])==FALSE) $errors->add('email', sprintf(esc_html__('%s is invalid.', 'ApplyOnline'), '"'.$val['label'].'"'));
+                        if(!empty($form_data[$key]) and is_email($form_data[$key])==FALSE) $errors->add('email', sprintf(esc_html__('%s is invalid.', 'apply-online'), '"'.$val['label'].'"'));
                     }

                     //File validation & verification.
                     if(isset($val['required']) AND $val['type'] == 'file'){
-                        //if(!isset($_FILES[$key]['name'])) $errors->add('file', sprintf(esc_html__('%s is not a file.', 'ApplyOnline'), str_replace('_',' ', substr($key, 9))));
-                        if((int)$val['required'] == 1 and empty($_FILES[$key]['name'])) $errors->add('required', sprintf(esc_html__('%s is required.', 'ApplyOnline'), '"'.$val['label'].'"'));
+                        //if(!isset($_FILES[$key]['name'])) $errors->add('file', sprintf(esc_html__('%s is not a file.', 'apply-online'), str_replace('_',' ', substr($key, 9))));
+                        if((int)$val['required'] == 1 and empty($_FILES[$key]['name'])) $errors->add('required', sprintf(esc_html__('%s is required.', 'apply-online'), '"'.$val['label'].'"'));
                     }

                     //chek required fields for non File Fields.
                     if( isset($val['required']) AND (int)$val['required'] == 1 and $val['type'] != 'file'){
                         $form_data[$key] = is_array($form_data[$key]) ? array_map('sanitize_text_field', $form_data[$key]) : sanitize_textarea_field($form_data[$key]);
-                        if(empty($form_data[$key])) $errors->add('required', sprintf (esc_html__('%s is required.', 'ApplyOnline'), '"'.$val['label'].'"') );
+                        if(empty($form_data[$key])) $errors->add('required', sprintf (esc_html__('%s is required.', 'apply-online'), '"'.$val['label'].'"') );
                     }
             endforeach;
             //Deprictated since 2.2.2. Will be deleted soon. Use aol_app_final_fields hook instead
@@ -865,7 +866,7 @@

             if( !empty($error_messages ) ){
                 $error_html = implode('<br />', $error_messages);
-                $response = array( 'reason' => esc_html__('Missing required fields', 'ApplyOnline'), 'message' => $error_html );    //generate the error response.
+                $response = array( 'reason' => esc_html__('Missing required fields', 'apply-online'), 'message' => $error_html );    //generate the error response.

                 //response output
                 $this->response($response, 406);
@@ -954,7 +955,7 @@
             $divert_page = get_option('aol_thankyou_page');

             empty($divert_page) ? $divert_link = null :  $divert_link = get_page_link($divert_page);
-            $message = str_replace('[id]', $pid, get_option_fixed('aol_application_success_alert', esc_html__('Form has been submitted successfully with application id [id]. If required, we will get back to you shortly!', 'ApplyOnline')) );
+            $message = str_replace('[id]', $pid, get_option_fixed('aol_application_success_alert', esc_html__('Form has been submitted successfully with application id [id]. If required, we will get back to you shortly!', 'apply-online')) );
             // generate the response alert.
             $response = apply_filters(
                         'aol_application_success_response',
@@ -1040,20 +1041,20 @@
              *
              */

-            //$subject = sprintf(esc_html__('New application for %s', 'ApplyOnline'), sanitize_text_field($post->post_title));
+            //$subject = sprintf(esc_html__('New application for %s', 'apply-online'), sanitize_text_field($post->post_title));
             $subject = str_replace( array('[id]' ,'[title]'), array($post->ID ,$post->post_title), get_option('aol_admin_mail_subject', 'New application [id] for [title]') );
             $headers = aol_from_mail_header();

             //@todo need a filter hook to modify content of this email message and to add a from field in the message.
-            $message=   '<p>'.esc_html__('Hi,', 'ApplyOnline').'</p>'
+            $message=   '<p>'.esc_html__('Hi,', 'apply-online').'</p>'
                         .'<p>'
-                        .sprintf(esc_html__('A new application for the ad %1$s received on %2$s website.', 'ApplyOnline'), '<b>'.$post->post_title.'</b>', '<b>'.get_bloginfo('name').'</b>')
+                        .sprintf(esc_html__('A new application for the ad %1$s received on %2$s website.', 'apply-online'), '<b>'.$post->post_title.'</b>', '<b>'.get_bloginfo('name').'</b>')
                         .'</p><p>'
-                        .sprintf(esc_html__('%sClick Here%s to access this application.', 'ApplyOnline'),'<b><a href="'.$post_url.'">', '</a></b>')
+                        .sprintf(esc_html__('%sClick Here%s to access this application.', 'apply-online'),'<b><a href="'.$post_url.'">', '</a></b>')
                         .'</p>'
-                        .esc_html__('Thank you', 'ApplyOnline')
+                        .esc_html__('Thank you', 'apply-online')
                         .'<br /><p>----<br />'
-                        .sprintf(esc_html__('This is an automated response from Apply Online plugin on %s', 'ApplyOnline'), '<a href="'.site_url().'" >'.get_bloginfo('name').'</a>')
+                        .sprintf(esc_html__('This is an automated response from Apply Online plugin on %s', 'apply-online'), '<a href="'.site_url().'" >'.get_bloginfo('name').'</a>')
                         .'</p>';

             $message = apply_filters('aol_email_notification', $message, $post_id); //Deprecated.
--- a/apply-online/rest/class-applyonline-rest-functions.php
+++ b/apply-online/rest/class-applyonline-rest-functions.php
@@ -0,0 +1,431 @@
+<?php
+/**
+ * REST callback functions of the plugin.
+ *
+ * @link
+ * @since      2.6.7.3
+ *
+ * @package    Applyonline
+ * @subpackage Applyonline/rest
+ */
+
+/**
+ * The updater functionality of the plugin.
+ *
+ * Defines the plugin name, version
+ *
+ * @package    Applyonline
+ * @subpackage Applyonline/rest
+ * @author     Farhan Noor <profiles.wordpress.org/farhannoor>
+ */
+class Applyonline_Rest_Functions{
+
+    var $uploads;
+
+    function __construct() {
+        add_filter( 'aol_form_errors', [$this, 'file_uploader'], 10,3 );
+    }
+
+        function upload_path($uploads){
+                $subdir = apply_filters('aol_upload_folder', 'applyonline');
+                //$default = wp_upload_dir(); $default['basedir'];
+                $aol_upload_path = get_option('aol_upload_path');
+                $uploads['path'] = wp_normalize_path($uploads['basedir'] . '/' . $subdir);
+                $uploads['subdir'] = wp_normalize_path( '/' . $subdir);
+                $uploads['url'] = $uploads['baseurl']. '/' . $subdir;
+
+                if(!empty($aol_upload_path)){
+                    $uploads['basedir'] = $aol_upload_path;
+                    $uploads['path'] = wp_normalize_path($aol_upload_path . '/' . $subdir);
+                }
+                return $uploads;
+        }
+
+        function file_uploader($errors, $post, $files){
+            if(empty($files)) return $errors; //If no files are being uploaded, just quit.
+
+            $upload_overrides = array( 'test_form' => false );
+
+            /*Initialixing Variables*/
+            //$errors = new WP_Error();
+
+            $uploads = array();
+            $user = get_userdata(get_current_user_id());
+
+            if ( ! function_exists( 'wp_handle_upload' ) ) {
+                require_once( ABSPATH . 'wp-admin/includes/file.php' );
+            }
+
+            foreach($files as $key => $val):
+                if(empty($val['name'])) continue;
+
+                $field = get_post_meta($post['ad_id'], $key, TRUE);
+
+                if( isset($field['allowed_file_types']) AND !empty($field['allowed_file_types']) ){
+                    $allowed_types = str_replace(' ', '',  $field['allowed_file_types']);
+                } else{
+                    $allowed_types = str_replace(' ', '', get_option('aol_allowed_file_types'));
+                }
+
+                //Check if single File Type or multiple, if multiple convert it to an array.
+                $allowed_types = strstr($allowed_types, ',') == FALSE ? array($allowed_types) : explode(',', $allowed_types );
+
+                $upload_size = empty($field['allowed_size']) ? get_option_fixed('aol_upload_max_size', 1) : $field['allowed_size'];
+                $max_upload_size = $upload_size*1048576; //Multiply by KBs
+
+                if($max_upload_size < $val['size']){
+                        $errors->add(413, sprintf(esc_html__( '%s is oversized. Must be under %s MB', 'apply-online' ), $val['name'] , $upload_size));
+                }
+
+                /* Check File Size */
+                $file_type_match = 0;
+                $filetype = wp_check_filetype(  $val['name'] );
+                $file_ext = strtolower($filetype['ext']);
+                if( !in_array($file_ext, $allowed_types) ) $errors->add(406, sprintf(esc_html__( 'Invalid file %1$s. Allowed fil

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-57721
# Virtual patch: Block unauthenticated REST API access to ApplyOnline plugin endpoints
SecRule REQUEST_URI "@rx ^/wp-json/applyonline/vd+/" 
  "id:20261994,phase:1,deny,status:403,chain,msg:'CVE-2026-57721 - ApplyOnline REST API missing authorization',severity:'CRITICAL',tag:'CVE-2026-57721'"
  SecRule REQUEST_HEADERS:Authorization "@rx ^$" 
    "id:20261995,chain"
    SecRule REQUEST_COOKIES:/^wordpress_logged_in_/ "@rx ^$" 
      "id:20261996,t:none"

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School