#1560 Fix - Membership thank you page leaking another member's account details (#1427)

* #1408 Fix - Prevent membership privilege escalation and open redirect after login

* #1408 Fix - Address Copilot review: document meta auth_callback signature and drop dead AJAX-login code

* #1408 Fix - Match the meta auth_callback to WP's 6-arg filter signature and dedupe the redirect host

* #1408 Fix - Evaluate the meta auth_callback against the user WordPress passes, not the current user

* #1408 Fix - Reject a forged gateway on a free membership so it cannot take the paid order path

* #1560 Fix - Prevent membership thank you page leaking another member's account details

* #1560 Fix - Address Copilot review: defer_role by plan type, sanitize transaction_id, respect meta auth chain

---------

Co-authored-by: milan88888 <chaudharymilan996@gmail.com>

Author: deepench

modules/membership/includes/Admin/Services/MembersService.php

@@ -163,6 +163,7 @@ public function prepare_members_data( $data, $context = 'admin' ) {
 				'membership'     => absint( $data['membership'] ),
 				'start_date'     => date( 'Y-m-d', strtotime( $data['start_date'] ) ),
 				'payment_method' => sanitize_text_field( $data['payment_method'] ?? '' ),
+				'type'           => isset( $membership_meta['type'] ) ? sanitize_text_field( $membership_meta['type'] ) : 'unknown',
 			);
 
 			if ( isset( $data['is_purchasing_multiple'] ) ) {

modules/membership/includes/Admin/Services/MembershipService.php

@@ -233,8 +233,9 @@ public function create_membership_order_and_subscription( $data ) {
 			$members_data = $this->members_service->prepare_members_data( $data, 'frontend' );
 			$member       = get_user_by( 'login', $data['username'] );
 
-			// Update user source and add membership_role.
-			$members_data['defer_role'] = ! empty( $members_data['membership_data']['payment_method'] ) && 'free' !== $members_data['membership_data']['payment_method'];
+			// Update user source and add membership_role; a free plan always grants immediately.
+			$members_data['defer_role'] = 'free' !== ( $members_data['membership_data']['type'] ?? 'unknown' )
+				&& 'free' !== ( $members_data['membership_data']['payment_method'] ?? '' );
 			$this->members_service->update_user_meta( $members_data, $member->ID );
 
 			$subscription_service = new SubscriptionService();

modules/membership/includes/Admin/Services/SubscriptionService.php

@@ -329,7 +329,13 @@ public function get_membership_plan_details( $data ) {
 
 		if ( ! empty( $data['context'] ) && 'thank_you_page' === $data['context'] && ! empty( $data['transaction_id'] ) ) {
 			$order_by_txn = $this->orders_repository->get_order_by_transaction_id( $data['transaction_id'] );
-			if ( ! empty( $order_by_txn ) && ! empty( $order_by_txn['ID'] ) ) {
+
+			// Only trust this order if it belongs to the member the page is rendered for,
+			// otherwise a submitted transaction_id could surface another member's order.
+			if ( ! empty( $order_by_txn ) && ! empty( $order_by_txn['ID'] )
+				&& isset( $order_by_txn['user_id'], $data['member_id'] )
+				&& (int) $order_by_txn['user_id'] === (int) $data['member_id']
+			) {
 				$member_order = $order_by_txn;
 			}
 		}

modules/membership/includes/Templates/thank-you-page.php

@@ -2,7 +2,7 @@
 
 $bank_data         = ( isset( $_GET['info'] ) && ! empty( $_GET['info'] ) ) ? wp_kses_post( $_GET['info'] ) : '';
 $show_bank_data    = ( 'Free' === $bank_data || empty( $bank_data ) ) ? false : true;
-$transaction_id    = ( isset( $_GET['transaction_id'] ) && ! empty( $_GET['transaction_id'] ) ) ? wp_kses_post( $_GET['transaction_id'] ) : '';
+$transaction_id    = ( isset( $_GET['transaction_id'] ) && ! empty( $_GET['transaction_id'] ) ) ? sanitize_text_field( wp_unslash( $_GET['transaction_id'] ) ) : '';
 $username          = ( isset( $_GET['username'] ) && ! empty( $_GET['username'] ) ) ? wp_kses_post( $_GET['username'] ) : '';
 $main_content      = ! empty( $attributes['header'] ) ? wp_kses_post( $attributes['header'] ) : sprintf(
 	__( 'Thank You! Your registration was completed successfully.', 'user-registration' ),
@@ -48,20 +48,23 @@
 		<div class="ur-message">
 			<p>
 			<?php
-				$username = isset( $_GET['username'] ) ? sanitize_text_field( wp_unslash( $_GET['username'] ) ) : '';
-
 				$values = array();
 
-			if ( ! empty( $username ) ) {
-				$user                = get_user_by( 'login', sanitize_text_field( $username ) );
-				$values['member_id'] = $user->ID;
-				$values['email']     = $user->user_email;
-				$values['context']   = 'thank_you_page';
-				if ( ! empty( $transaction_id ) ) {
-					$values['transaction_id'] = $transaction_id;
-				}
+				// Smart tags resolve only for the logged-in visitor's own account; a requested
+				// username is never trusted, so one member cannot read another's details here.
+			if ( is_user_logged_in() ) {
+				$user = wp_get_current_user();
 
-				$main_content = apply_filters( 'user_registration_process_smart_tags', $main_content, $values );
+				if ( $user && $user->exists() ) {
+					$values['member_id'] = $user->ID;
+					$values['email']     = $user->user_email;
+					$values['context']   = 'thank_you_page';
+					if ( ! empty( $transaction_id ) ) {
+						$values['transaction_id'] = $transaction_id;
+					}
+
+					$main_content = apply_filters( 'user_registration_process_smart_tags', $main_content, $values );
+				}
 			}
 				echo wp_kses_post( $main_content );
 			?>