public function file_download( array $payload ) {
    if ( ! isset( $payload['filename'] ) ) {
        wp_send_json_error( __( 'Filename is required.', 'storeengine' ) );
    }

    $filename = $payload['filename'];
    $filepath = Helper::get_upload_dir() . '/csv/' . $filename;  // <-- VULNERABLE TO PATH TRAVERSAL!
    
    // NO CAPABILITY CHECK - ANY USER CAN DOWNLOAD ANY FILE!
    // NO PATH SANITIZATION - DIRECT CONCATENATION ALLOWS ../ ATTACKS!
    
    if ( ! file_exists( $filepath ) ) {
        wp_send_json_error( __( 'File not found.', 'storeengine' ) );
    }

    header( 'Content-Type: application/octet-stream' );
    header( 'Content-Disposition: attachment; filename="' . $filename . '"' );
    readfile( $filepath );  // <-- READS AND OUTPUTS ANY FILE!
    exit;
}

// Helper::get_upload_dir() returns:
$upload = wp_upload_dir();
return $upload['basedir'] . '/storeengine_uploads';

// So the full path becomes:
$filepath = '/path/to/wp-content/uploads/storeengine_uploads/csv/' . $filename;

// With path traversal, this becomes:
$filepath = '/path/to/wp-content/uploads/storeengine_uploads/csv/../../../wp-config.php'
$filepath = '/path/to/wp-content/uploads/storeengine_uploads/csv/../../../../../../etc/passwd'

public function _get_script_data(): array {
    // ... other data ...
    return [
        'nonce'             => wp_create_nonce( 'wp_rest' ),
        'storeengine_nonce' => wp_create_nonce( 'storeengine_nonce' ), // Line 279 - EXPOSED TO ALL USERS
        'rest_url'          => esc_url_raw( rest_url() ),
        // ... other data ...
    ];
}

wp_localize_script(
    'storeengine-frontend-scripts',
    'StoreEngineGlobal',
    $this->get_frontend_script_data() // Calls _get_script_data()
);

protected function check_permission( string $capability, bool $allow_visitors = false ) {
    if ( ( ! is_user_logged_in() && ! $allow_visitors ) || ( is_user_logged_in() && $capability && ! current_user_can( $capability ) ) ) {
        return new WP_Error(/* ... */);
    }
    return true;
}