Don't rely on user passed into user_has_cap. (#319)

WordPress · Oct 23, 2024 · fe0a981 · fe0a981
1 parent 967c4ac
commit fe0a981
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/wporg-two-factor.php b/wporg-two-factor.php
@@ -193,7 +193,7 @@ function remove_super_admins_until_2fa_enabled() : void {
  * perform privileged actions on the front end, via the REST API, etc.
  */
 function remove_capabilities_until_2fa_enabled( array $allcaps, array $caps, array $args, WP_User $user ) : array {
-	if ( 0 === $user->ID || ! user_requires_2fa( $user ) ) {
+	if ( 0 === $user->ID || $user->ID !== get_current_user_id() || ! user_requires_2fa( $user ) ) {
 		return $allcaps;
 	}