WP Activity Log - Insecure deserialization

 228 | public static function write_csv_ajax() {
 229 | if ( ! array_key_exists( 'nonce', $_POST ) || ! wp_verify_nonce( $_POST['nonce'], 'wsal-export-csv-nonce' ) ) { // php
 230 | wp_send_json_error( esc_html_e( 'nonce is not provided or incorrect', 'wp-security-audit-log' ) );
 231 | die();
 232 | }
 233 |
 234 | if ( ! array_key_exists( 'query', $_POST ) ) {
 235 | wp_send_json_error( esc_html_e( 'query is not provided or incorrect', 'wp-security-audit-log' ) );
 236 | die();
 237 | } else {
> 238 |     $query = unserialize( ase64_decode( \sanitize_text_field( \wp_unslash( $_POST['query'] ) ) ) );
  239 |    }
  240 |
  241 |    if ( ! array_key_exists( 'order', $_POST ) ) {
  242 |     wp_send_json_error( esc_html_e( 'order is not provided or incorrect', 'wp-security-audit-log' ) );
  243 |     die();
  244 |    }
  245 |
  246 |    if ( ! array_key_exists( 'step', $_POST ) ) {
  247 |     wp_send_json_error( esc_html_e( 'step is not provided or incorrect', 'wp-security-audit-log' ) );
  248 |     die();
      ^ Col 0