Ticket #28821: 28821.diff

src/wp-admin/includes/plugin.php

@@ -1676 +1676 @@
  * @global array $_wp_submenu_nopriv
  * @global string $plugin_page
  * @global array $_registered_pages
+ * @global array $admin_page_hooks
  */
 function user_can_access_admin_page() {
         global $pagenow, $menu, $submenu, $_wp_menu_nopriv, $_wp_submenu_nopriv,
-                $plugin_page, $_registered_pages;
+                $plugin_page, $_registered_pages, $admin_page_hooks;
 
         $parent = get_admin_page_parent();
 
@@ -1694 +1695 @@
 
                 if ( !isset($_registered_pages[$hookname]) )
                         return false;
+
+                // It's a toplevel page, but accessed with the wrong parent.
+                if ( isset( $admin_page_hooks[$plugin_page] ) && $parent !== $plugin_page ) {
+                        return false;
+                }
         }
 
         if ( empty( $parent) ) {