Missing Function Level Access Control in /cindex.php/widget/customize/

How it was found

Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.

The URL "https://www.bookfresh.com/cindex.php/widget/customize/" is accessible to anyone even without authentication. The page should only be accessible to authenticated users.