Changeset 60491 for trunk/src/wp-includes/capabilities.php

Timestamp:

07/21/2025 05:58:11 PM (10 months ago)

Author:

SergeyBiryukov

Message:

Role/Capability: Ensure that logged-out users cannot edit themselves.

Follow-up to [3846], [6697], [14189], [21152].

Props dd32, peterwilsoncc, johnbillion, mukesh27, swissspidy, SergeyBiryukov.
Fixes #63684.

File:

• trunk/src/wp-includes/capabilities.php (modified) (1 diff)

trunk/src/wp-includes/capabilities.php

@@ -61 +61 @@
         case 'edit_user':
         case 'edit_users':
+            // Non-existent users can't edit users, not even themselves.
+            if ( $user_id < 1 ) {
+                $caps[] = 'do_not_allow';
+                break;
+            }
+
             // Allow user to edit themselves.
             if ( 'edit_user' === $cap && isset( $args[0] ) && $user_id === (int) $args[0] ) {