Foundation Inkfire Login 2.0.27

Fix: admin password reset no longer blocked by the front-end CSRF check

Symptom

Clicking Send Reset Link on a user's profile in wp-admin failed with a red Security check failed. error (HTTP 403). No reset email was ever sent, so users who asked an administrator to reset their password received nothing.

Cause

WordPress core's retrieve_password() fires the global lostpassword_post hook for its admin reset tools as well as the wp-login.php form. This plugin hooked its front-end nonce check to lostpassword_post, but the admin tools never render the ifls_form_nonce field — that field only exists on the wp-login.php forms — so every admin-initiated reset was rejected.

Two paths were affected:

• user-edit.php → Send Reset Link button (wp_ajax_send_password_reset())
• users.php → Send password reset bulk action

Fix

Both admin actions are exempted from the plugin's nonce check. Core already validates its own nonce (check_ajax_referer / check_admin_referer) and an edit_user capability check before calling retrieve_password(), so by the time this hook runs the request has already been authenticated.

The exemption is deliberately narrower than a blanket is_admin() bypass: is_admin() is also true for anonymous requests to admin-ajax.php, so the check additionally requires an authenticated user holding the same capability core requires.

No change to front-end security. Lost-password, register and reset-password forms on wp-login.php still require a valid plugin nonce.

Verified

Tested against WordPress 7.0.2 / PHP 8.2 on three live sites (base-uk.org, thatdeveloper.co.uk, flotsamfables.com — the last with WooCommerce), covering 12 scenarios:

Scenario	Expected	Result
Admin "Send Reset Link" (AJAX)	allowed	✅
Admin bulk reset (action / action2)	allowed	✅
Front-end form, valid nonce	allowed	✅
WooCommerce lost password	allowed	✅
Front-end form, no nonce	blocked	✅
Front-end form, bad nonce	blocked	✅
Anonymous admin-ajax.php spoof	blocked	✅
Subscriber targeting another user	blocked	✅
Subscriber forging bulk action	blocked	✅
Other admin action (delete)	blocked	✅

Confirmed end-to-end over real HTTP: 403 Security check failed on 2.0.26 → {"success":true} on 2.0.27.

Upgrading

Automatic via the bundled updater. Sites still pointing at the old hawks010 repository URL are unaffected — GitHub redirects the API and asset requests to the new Inkfire-limited location (verified).