From a19065c3e1efd2b235a9d282e6f79b02c5ce5bac Mon Sep 17 00:00:00 2001 From: Ariful Hoque Date: Fri, 31 Jul 2026 12:11:35 +0600 Subject: [PATCH] fix: fail closed on registration nonce and use safe redirect (CSRF) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit process_registration() called wp_verify_nonce() in void context, so any non-empty _wpnonce passed and registration proceeded on any URL — a CSRF that could create an account and, with autologin on, fixate the victim's session. Fail closed: return early when the nonce is missing or invalid. Also switch the post-registration redirect from wp_redirect() to wp_safe_redirect() so an attacker-supplied redirect_to cannot bounce the victim to an arbitrary external host (matches the existing safe redirect later in the same method). Reported by Yaswanth Reddy Sunkara. Closes weDevsOfficial/wpuf-pro#1654. --- includes/Frontend/Registration.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/includes/Frontend/Registration.php b/includes/Frontend/Registration.php index 2295503fb..bcec7259c 100644 --- a/includes/Frontend/Registration.php +++ b/includes/Frontend/Registration.php @@ -161,9 +161,10 @@ public function process_registration() { if ( ! empty( $_POST['wpuf_registration'] ) && ! empty( $_POST['_wpnonce'] ) ) { $userdata = []; $user = ''; - if ( isset( $_POST['_wpnonce'] ) ) { - $nonce = sanitize_key( wp_unslash( $_POST['_wpnonce'] ) ); - wp_verify_nonce( $nonce, 'wpuf_registration_action' ); + $nonce = isset( $_POST['_wpnonce'] ) ? sanitize_key( wp_unslash( $_POST['_wpnonce'] ) ) : ''; + + if ( ! wp_verify_nonce( $nonce, 'wpuf_registration_action' ) ) { + return; } $validation_error = new WP_Error(); $reg_fname = isset( $_POST['reg_fname'] ) ? sanitize_text_field( wp_unslash( $_POST['reg_fname'] ) ) : ''; @@ -336,7 +337,7 @@ public function process_registration() { } else { $redirect = $this->get_registration_url() . '?success=yes'; } - wp_redirect( apply_filters( 'wpuf_registration_redirect', $redirect, $user ) ); + wp_safe_redirect( apply_filters( 'wpuf_registration_redirect', $redirect, $user ) ); exit; } }