Skip to content

v1.2.0 — Blokada wp_insert_user() direct calls

Choose a tag to compare

View all tags
@schlebek schlebek released this 26 May 20:43
· 4 commits to master since this release
v1.2.0
c0e031c

What's new

Added

  • Low-level wp_pre_insert_user_data filter (priority 1) that intercepts any direct wp_insert_user() call from non-admins — catches form builders, membership plugins and custom code that bypass standard registration hooks. A WP_Error is returned before any database write occurs.
  • New log label: wp_insert_user (direct) for attempts caught by this filter.

Fixed

  • Registrations bypassing all standard hooks (resulting in an empty log) are now blocked at the lowest possible WordPress level.

Exempt from blocking (intentional)

  • Updates to existing users
  • Administrators with the create_users capability
  • WP-CLI (migrations, imports)

Upgrade

Replace registration-blocker.php with the new version. No deactivation/reactivation required.

Assets 2
Loading