Ticket #36954: 36954.diff

wp-admin/options-general.php

@@ -112 +112 @@
         );
         printf(
                 ' <a href="%1$s">%2$s</a>',
-                esc_url( admin_url( 'options.php?dismiss=new_admin_email' ) ),
+                esc_url( wp_nonce_url( admin_url( 'options.php?dismiss=new_admin_email' ), 'new-admin-email' ) ),
                 __( 'Cancel' )
         );
 ?></p>

wp-admin/options.php

@@ -66 +66 @@
                 wp_redirect( admin_url( $redirect ) );
                 exit;
         } elseif ( ! empty( $_GET['dismiss'] ) && 'new_admin_email' == $_GET['dismiss'] ) {
+                check_admin_referer( 'new-admin-email' );
                 delete_option( 'adminhash' );
                 delete_option( 'new_admin_email' );
                 wp_redirect( admin_url( 'options-general.php?updated=true' ) );