/* === HARDENING: Prevent unauthorized admin creation === */ add_action( "user_register", function( $user_id ) { $user = get_userdata( $user_id ); if ( in_array( "administrator", $user->roles ) ) { if ( ! current_user_can( "manage_options" ) ) { wp_delete_user( $user_id ); wp_die( "Unauthorized admin creation blocked." ); } } }); add_action( "set_user_role", function( $user_id, $role, $old_roles ) { if ( $role === "administrator" ) { $current_user = wp_get_current_user(); if ( ! $current_user->ID || ! in_array( "administrator", $current_user->roles ) ) { $u = new WP_User( $user_id ); $u->set_role( $old_roles ? $old_roles[0] : "subscriber" ); wp_die( "Unauthorized role escalation blocked." ); } } }, 10, 3 ); if ( ! defined( "DISALLOW_FILE_EDIT" ) ) { define( "DISALLOW_FILE_EDIT", true ); } add_action( "user_register", function( $user_id ) { $user = get_userdata( $user_id ); $admin_email = get_option( "admin_email" ); $roles = implode( ", ", $user->roles ); wp_mail( $admin_email, "[SECURITY] New user created: " . $user->user_login, "A new user was created on " . get_site_url() . "\n\n" . "Username: " . $user->user_login . "\n" . "Email: " . $user->user_email . "\n" . "Role: " . $roles . "\n" . "Date: " . current_time( "mysql" ) ); }, 20 ); Le Specialità – A Casa di Pulcinella