Ticket #44601: 44601.2.diff

src/wp-includes/user.php

@@ -2196 +2196 @@
 function get_password_reset_key( $user ) {
         global $wpdb, $wp_hasher;
 
+        //Validating whether $user is what it is expected to be
+        if ( ! ( $user instanceof WP_User ) ) {
+                return new WP_Error( 'invalid_user_data', __( 'Invalid user data' ) );
+        }
+
         /**
          * Fires before a new password is retrieved.
          *
@@ -2222 +2227 @@
                 $allow = false;
         }
 
+
         /**
          * Filters whether to allow a password to be reset.
          *