should update_option() check "manage_options" capability?

[lllor]

As in the summary, please consider improving the security of update_option() by checking the related capability.

Or at least, write in the documentation that it's in the plugin author's duty to verify it.

Otherwise, a vulnerability may occur, as recently happened in the ND Shortcodes For Visual Composer plugin:

​https://blog.nintechnet.com/privilege-escalation-vulnerability-in-wordpress-nd-shortcodes-for-visual-composer-plugin/

Cheers.

[SergeyBiryukov]

Hi @lllor, welcome to WordPress Trac! Thanks for the ticket!

update_option() is a low-level utility function often used in contexts when there's no logged-in user (Cron, CLI tools, etc.), so checking capabilities is beyond its scope. See a similar discussion about wp_insert_post() in #19373.

Or at least, write in the documentation that it's in the plugin author's duty to verify it.

We could definitely clarify that in the documentation.

[lllor]

Replying to SergeyBiryukov:

Hi @lllor, welcome to WordPress Trac! Thanks for the ticket!

update_option() is a low-level utility function often used in contexts when there's no logged-in user (Cron, CLI tools, etc.), so checking capabilities is beyond its scope. See a similar discussion about wp_insert_post() in #19373.

Or at least, write in the documentation that it's in the plugin author's duty to verify it.

We could definitely clarify that in the documentation.

Excellent! So, if I haven't misunderstood, update_option must be used only in peculiar contexts and not as general-purpose interface to the wp-options provided to the plugins.

[SergeyBiryukov]

Replying to lllor:

Excellent! So, if I haven't misunderstood, update_option must be used only in peculiar contexts and not as general-purpose interface to the wp-options provided to the plugins.

It should be used for updating an option value in the database (instead of direct SQL queries, for example).

As you wrote in the ticket description, it's plugin author's responsibility to check the appropriate capabilities before saving any option changes.

Marking as a good-first-bug to reflect that in the function documentation.

[dinhtungdu]

Replying to SergeyBiryukov:

Marking as a good-first-bug to reflect that in the function documentation.

I updated the doc of update_option to reflect the topic we discussed here.

[dinhtungdu]

Fix grammar issues.

[SergeyBiryukov]

In 46120:

Docs: Clarify in update_option() description that it's plugin author's responsibility to check the current user's capabilities before saving any option changes.

Props dinhtungdu, lllor.
Fixes #47820.

[SergeyBiryukov]

In 46121:

Coding Standards: Fix WPCS issue in [46120].

See #47820.