2 | | |
3 | | It looks like the plugin is using |
4 | | |
5 | | {{{ |
6 | | add_action( 'delete_user', array( $this, 'delete_user_action' ) ); |
7 | | }}} |
8 | | |
9 | | and then using |
10 | | |
11 | | {{{ |
12 | | $reassign_id = isset( $_POST['reassign_user'] ) ? absint( $_POST['reassign_user'] ) : false; |
13 | | }}} |
14 | | |
15 | | I've not used this plugin and don't know it's code base, but just from a very quick skimming I wonder why it's not using the second input {{{$reassign}}} argument of the {{{delete_user}}} action: |
16 | | |
17 | | https://core.trac.wordpress.org/browser/tags/5.1.1/src/wp-admin/includes/user.php#L363 |
18 | | |
19 | | instead of looking into the global {{{$_POST}}} value? But I guess there's a good reason for that. |
20 | | |