Analysis Report · Folder Analysis cache/wp-simple-firewall_21.0.9 → cache/wp-simple-firewall_21.0.10 — CVE-2025-15370

Vulnerability Existed: yes
TRUE POSITIVE
Privilege Escalation / Improper Access Control - CWE-639 - src/lib/src/ActionRouter/Actions/Render/Components/UserMfa/ConfigEdit.php Lines 19-24

Old Code:
```php
$user = Services::WpUsers()->getUserById( (int)$this->action_data[ 'user_id' ] );
```

Fixed Code:
```php
$WPU = Services::WpUsers();
$currentUser = $WPU->getCurrentWpUser();
$requestedUserID = (int)( $this->action_data[ 'user_id' ] ?? 0 );
if ( $requestedUserID > 0 && $currentUser->ID !== $requestedUserID && !$WPU->isUserAdmin( $currentUser ) ) {
	throw new ActionException( __( 'Invalid profile request.', 'wp-simple-firewall' ) );
}

$user = $requestedUserID > 0 ? $WPU->getUserById( $requestedUserID ) : $currentUser;
```

Explanation:
The original code allowed any user to access MFA configuration for any other user by simply providing a `user_id` parameter without proper authorization checks. This is a classic privilege escalation vulnerability where a non-admin user could potentially view or modify the MFA settings of any other user account. The fix adds proper access control by:
1. Retrieving the current authenticated user
2. Validating that non-admin users can only access their own MFA configuration
3. Only allowing admin users to access other users' configurations
4. Throwing an `ActionException` if an unauthorized access attempt is made
5. Defaulting to the current user if no valid user_id is provided

This directly addresses CWE-639 (Authorization through User-Controlled Key).

```
Vulnerability Existed: yes
TRUE POSITIVE
Broken Access Control - CWE-639 - src/lib/src/ActionRouter/Actions/Render/Components/UserMfa/ConfigForm.php - Lines 26-31

[Old Code]
$user = $WPU->getUserById( (int)$this->action_data[ 'user_id' ] ?? $WPU->getCurrentWpUserId() );

[Fixed Code]
$currentUser = $WPU->getCurrentWpUser();
$requestedUserID = (int)( $this->action_data[ 'user_id' ] ?? 0 );
if ( $requestedUserID > 0 && $currentUser->ID !== $requestedUserID && !self::con()->this_req->is_security_admin ) {
    throw new ActionException( __( 'Invalid profile request.', 'wp-simple-firewall' ) );
}

$user = $requestedUserID > 0 ? $WPU->getUserById( $requestedUserID ) : $currentUser;

Explanation:
The original code allowed any authenticated user to view or configure MFA settings for any other user by simply passing a `user_id` parameter in the request, with no authorization check. An authenticated user could manipulate the `user_id` value to access another user's MFA configuration form.

The fix introduces proper authorization validation: it retrieves the current user, extracts the requested user ID, and explicitly checks that either (1) the requested user matches the current user's ID, or (2) the current user is a security administrator. If neither condition is met, an ActionException is thrown, preventing unauthorized access to other users' MFA configurations.
```