From 16a1e4349ce3a548bf4921a739e47fa77af3e22a Mon Sep 17 00:00:00 2001 From: Ajay D'Souza Date: Mon, 2 Nov 2026 13:12:58 +0000 Subject: [PATCH 1/2] Remove logged-out AJAX hooks from the settings search handlers The settings Tom Select search handlers were also registered as wp_ajax_nopriv_ actions. They only serve admin settings screens, so logged-out access is never needed. --- class-settings.php | 1 - 1 file changed, 1 deletion(-) diff --git a/class-settings.php b/class-settings.php index 3506df7..b40cd22 100644 --- a/class-settings.php +++ b/class-settings.php @@ -89,7 +89,6 @@ public function __construct() { Hook_Registry::add_filter( self::$prefix . '_settings_sanitize', array( $this, 'change_settings_on_save' ), 99 ); Hook_Registry::add_action( 'admin_menu', array( $this, 'redirect_on_save' ) ); - Hook_Registry::add_action( 'wp_ajax_nopriv_' . self::$prefix . '_taxonomy_search_tom_select', array( __CLASS__, 'taxonomy_search_tom_select' ) ); Hook_Registry::add_action( 'wp_ajax_' . self::$prefix . '_taxonomy_search_tom_select', array( __CLASS__, 'taxonomy_search_tom_select' ) ); } From 270b6c0137f721220f771b86b3738cc6c68bd3bf Mon Sep 17 00:00:00 2001 From: Ajay D'Souza Date: Mon, 2 Nov 2026 13:17:35 +0000 Subject: [PATCH 2/2] Only accept post IDs the saving user can read sanitize_postids_field() kept any existing post ID, so a user saving a post-ID field through the Metabox API could store IDs of private, draft or trashed posts and revisions. It now also drops IDs the saving user cannot read. CLI and cron saves, which have no user, keep the existing check. --- settings/class-settings-sanitize.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/settings/class-settings-sanitize.php b/settings/class-settings-sanitize.php index 5ffb614..0ac3879 100644 --- a/settings/class-settings-sanitize.php +++ b/settings/class-settings-sanitize.php @@ -175,7 +175,8 @@ public function sanitize_postids_field( $value ) { $ids = array_filter( array_map( 'absint', explode( ',', sanitize_text_field( wp_unslash( $value ) ) ) ) ); foreach ( $ids as $key => $value ) { - if ( false === get_post_status( $value ) ) { + // Drop missing posts, and posts the saving user cannot read (CLI and cron have no user). + if ( false === get_post_status( $value ) || ( is_user_logged_in() && ! current_user_can( 'read_post', $value ) ) ) { unset( $ids[ $key ] ); } }