UR-4797 Fix - Email confirmation workflow bypassed on profile update (#1383)

* UR-4797 Fix - Email confirmation workflow bypassed on profile update

* UR-4797 Fix - Derive is_admin_user server-side instead of trusting $_POST

$_POST['is_admin_user'] is client-supplied and spoofable - adding it to a normal profile save request skips email confirmation entirely. current_user_can('edit_user', $user_id) a few lines above already proves whether the actor may manage $user_id, so deriving is_admin_user from that (user_id !== current user) closes the gap without changing any downstream logic.

Author: saurab018

includes/class-ur-ajax.php

@@ -288,8 +288,9 @@ public static function update_profile_details() {
 				)
 			);
 		}
-
-		$is_admin_user                  = $_POST['is_admin_user'] ?? false;
+    
+		// Server-derived, not client-supplied - avoids a spoofable $_POST flag.
+		$is_admin_user                  = $user_id !== get_current_user_id();
 		list( $profile, $single_field ) = urm_process_profile_fields( $profile, $single_field, $form_data, $form_id, $user_id, $is_admin_user );
 		$user                           = get_userdata( $user_id );
 
@@ -316,7 +317,7 @@ public static function update_profile_details() {
 				'email'          => ! empty( $single_field['user_registration_user_email'] ) ? $single_field['user_registration_user_email'] : '',
 			);
 
-			if ( $email_updated && ! is_admin() ) {
+			if ( $email_updated && ! $is_admin_user ) {
 				UR_Form_Handler::send_confirmation_email( $user, $pending_email, $form_id );
 				$response['oldUserEmail'] = $user->user_email;
 				/* translators: %s : user email */
@@ -344,7 +345,7 @@ public static function update_profile_details() {
 				);
 			}
 
-			if ( is_admin() && ! empty( $pending_email ) ) {
+			if ( $is_admin_user && ! empty( $pending_email ) ) {
 				wp_update_user(
 					array(
 						'ID'         => $user_id,