fix: fail closed on registration nonce + safe redirect (CSRF session fixation)

[arifulhoque7]

Vulnerability

[WPScan] Registration nonce check has no effect, leading to login session fixation via CSRF (CVSS 4.3).

Registration::process_registration() (hooked on init, so it fires on any URL) called wp_verify_nonce() in void context — nothing branched on the result, so any non-empty _wpnonce passed and registration proceeded. With autologin_after_registration on (default), the handler cleared the visitor's auth cookie and set a new one, binding their browser to an attacker-created account. The post-registration redirect also used wp_redirect() on $_POST['redirect_to'] with no host allowlist, redirecting the victim off-site in the same request.

Fix (minimal, no behavior change for legit flows)

1. Fail closed on the nonce — return early when _wpnonce is missing or invalid. The real form (templates/registration-form.php) already mints wp_nonce_field( 'wpuf_registration_action' ), so valid registrations are unaffected.
2. wp_redirect() → wp_safe_redirect() for the post-registration redirect, matching the already-safe redirect later in the same method. Internal redirects keep working; external hosts are blocked.

Verified — before / after (local WP, real HTTP requests)

Invalid nonce (the PoC form):

	Result
Before (develop)	HTTP/2 302 → location: https://attacker.example.com/, `set-cookie: wordpress_logged_in_…=csrf_probe_user
After (patch)	HTTP/2 200, no redirect, no login cookie, user not created

Valid nonce (legit registration form), on the patched code:
HTTP/2 302 → location: https://wps-site.test/registration/?success=yes, user created — legit signup unaffected, and the redirect stays on-site.

Reported by external security researcher Yaswanth Reddy Sunkara — please credit in the changelog/advisory.

Closes weDevsOfficial/wpuf-pro#1654.

[coderabbitai]

Walkthrough

Registration now rejects failed nonce verification before processing and uses wp_safe_redirect() for the post-registration redirect.

Changes

Registration Security

Layer / File(s)	Summary
Registration validation and redirect includes/Frontend/Registration.php	The registration flow sanitizes and verifies the nonce before continuing. The post-registration redirect now uses wp_safe_redirect() while retaining the existing destination and filter.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks the nonce with care,
Then hops through redirects safe and fair.
Bad tokens stop the flow,
Safe paths guide the show,
While carrots cheer the guarded lair.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the nonce validation and safe redirect changes that address the registration security issues.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}