Merge branch 'dev' into remove-sql-calc-found-rows

brianhogg · web-flow · commit 0dad5bae24d1 · 2026-04-09T22:23:25.000+02:00
diff --git a/.changelogs/llms-verify-nonce-removal.yml b/.changelogs/llms-verify-nonce-removal.yml
@@ -0,0 +1,3 @@
+significance: patch
+type: changed
+entry: Using standard WP nonce check functions instead of llms_verify_nonce.
diff --git a/includes/abstracts/abstract.llms.admin.metabox.php b/includes/abstracts/abstract.llms.admin.metabox.php
@@ -466,7 +466,7 @@ public function register() {
 	 */
 	protected function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) || ! current_user_can( $this->capability, $post_id ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) || ! current_user_can( $this->capability, $post_id ) ) {
 			return -1;
 		}
 
diff --git a/includes/abstracts/llms-abstract-admin-wizard.php b/includes/abstracts/llms-abstract-admin-wizard.php
@@ -377,7 +377,7 @@ public function save(): ?WP_Error {
 		$nonce  = "llms_{$this->id}_nonce";
 		$action = "llms_{$this->id}_save";
 
-		if ( ! isset( $_POST[ $nonce ] ) || ! llms_verify_nonce( $nonce, $action ) || ! current_user_can( 'manage_lifterlms' ) ) {
+		if ( ! isset( $_POST[ $nonce ] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST[ $nonce ] ) ), $action ) || ! current_user_can( 'manage_lifterlms' ) ) {
 			return null;
 		}
 
diff --git a/includes/abstracts/llms-abstract-controller-user-engagements.php b/includes/abstracts/llms-abstract-controller-user-engagements.php
@@ -158,11 +158,8 @@ public function maybe_handle_awarded_engagement_sync_actions() {
 		}
 
 		// Verify nonce.
-		if ( ! llms_verify_nonce(
-			"_llms_{$this->engagement_type}_sync_actions_nonce",
-			"llms-{$this->engagement_type}-sync-actions",
-			'GET'
-		) ) {
+		$nonce_field = "_llms_{$this->engagement_type}_sync_actions_nonce";
+		if ( ! isset( $_REQUEST[ $nonce_field ] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ $nonce_field ] ) ), "llms-{$this->engagement_type}-sync-actions" ) ) {
 			$result = new WP_Error(
 				"llms-sync-awarded-{$this->engagement_type}s-invalid-nonce",
 				$this->get_text( self::TEXT_SYNC_AWARDED_ENGAGEMENTS_INVALID_NONCE )
diff --git a/includes/abstracts/llms-abstract-email-provider.php b/includes/abstracts/llms-abstract-email-provider.php
@@ -253,7 +253,8 @@ public function ajax_callback_remote_install_verify() {
 	 */
 	protected function can_remote_install() {
 
-		if ( ! llms_verify_nonce( '_llms_' . $this->id . '_nonce', 'llms-' . $this->id . '-install' ) ) {
+		$nonce_field = '_llms_' . $this->id . '_nonce';
+		if ( ! isset( $_REQUEST[ $nonce_field ] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ $nonce_field ] ) ), 'llms-' . $this->id . '-install' ) ) {
 			return array(
 				'code'    => 'llms_' . $this->id . '_install_nonce_failure',
 				'message' => esc_html__( 'Security check failed.', 'lifterlms' ),
diff --git a/includes/admin/class-llms-admin-export-download.php b/includes/admin/class-llms-admin-export-download.php
@@ -45,7 +45,7 @@ public function maybe_serve_export() {
 		}
 
 		// Verify nonce.
-		if ( ! llms_verify_nonce( 'llms_dl_export_nonce', LLMS_Abstract_Exportable_Admin_Table::EXPORT_NONCE_ACTION, 'GET' ) ) {
+		if ( ! isset( $_REQUEST['llms_dl_export_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_dl_export_nonce'] ) ), LLMS_Abstract_Exportable_Admin_Table::EXPORT_NONCE_ACTION ) ) {
 			wp_die( esc_html__( 'Cheatin&#8217; huh?', 'lifterlms' ) );
 		}
 
diff --git a/includes/admin/class-llms-admin-review.php b/includes/admin/class-llms-admin-review.php
@@ -123,7 +123,7 @@ public function admin_footer( $text ) {
 	 */
 	public function dismiss() {
 
-		if ( ! current_user_can( 'manage_lifterlms' ) || ! llms_verify_nonce( 'nonce', 'llms-admin-review-request-dismiss' ) ) {
+		if ( ! current_user_can( 'manage_lifterlms' ) || ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'llms-admin-review-request-dismiss' ) ) {
 			wp_die();
 		}
 
diff --git a/includes/admin/class.llms.admin.addons.php b/includes/admin/class.llms.admin.addons.php
@@ -239,7 +239,7 @@ private function get_products_for_cat( $cat, $include_bundles = true ) {
 	public function handle_actions() {
 
 		// Activate & deactivate addons.
-		if ( llms_verify_nonce( '_llms_manage_addon_nonce', 'llms_manage_addon' ) ) {
+		if ( isset( $_REQUEST['_llms_manage_addon_nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_manage_addon_nonce'] ) ), 'llms_manage_addon' ) ) {
 
 			$this->handle_manage_addons();
 			LLMS_Admin_Notices::output_notices();
diff --git a/includes/admin/class.llms.admin.import.php b/includes/admin/class.llms.admin.import.php
@@ -81,7 +81,7 @@ public function add_help_tabs() {
 	 */
 	public function cloud_import() {
 
-		if ( ! llms_verify_nonce( 'llms_cloud_importer_nonce', 'llms-cloud-importer' ) || ! current_user_can( 'manage_lifterlms' ) ) {
+		if ( ! isset( $_REQUEST['llms_cloud_importer_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_cloud_importer_nonce'] ) ), 'llms-cloud-importer' ) || ! current_user_can( 'manage_lifterlms' ) ) {
 			return false;
 		}
 
@@ -277,7 +277,7 @@ protected function show_error( $error ) {
 	 */
 	public function upload_import() {
 
-		if ( ! llms_verify_nonce( 'llms_importer_nonce', 'llms-importer' ) || ! current_user_can( 'manage_lifterlms' ) || empty( $_FILES['llms_import'] ) ) {
+		if ( ! isset( $_REQUEST['llms_importer_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_importer_nonce'] ) ), 'llms-importer' ) || ! current_user_can( 'manage_lifterlms' ) || empty( $_FILES['llms_import'] ) ) {
 			return false;
 		}
 
diff --git a/includes/admin/class.llms.admin.notices.php b/includes/admin/class.llms.admin.notices.php
@@ -246,7 +246,7 @@ public static function has_notice( $notice_id ) {
 	 */
 	public static function hide_notices() {
 		if ( ( isset( $_GET['llms-hide-notice'] ) || isset( $_GET['llms-remind-notice'] ) ) && isset( $_GET['_llms_notice_nonce'] ) ) {
-			if ( ! llms_verify_nonce( '_llms_notice_nonce', 'llms_hide_notices_nonce', 'GET' ) ) {
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_llms_notice_nonce'] ) ), 'llms_hide_notices_nonce' ) ) {
 				wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
 			}
 			if ( ! current_user_can( 'manage_options' ) ) {
diff --git a/includes/admin/class.llms.admin.page.status.php b/includes/admin/class.llms.admin.page.status.php
@@ -74,7 +74,7 @@ public static function add_core_tools( $tools ) {
 	 */
 	private static function do_tool() {
 
-		if ( ! llms_verify_nonce( '_wpnonce', 'llms_tool' ) || ! current_user_can( 'manage_lifterlms' ) ) {
+		if ( ! isset( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'llms_tool' ) || ! current_user_can( 'manage_lifterlms' ) ) {
 			wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
 		}
 
@@ -265,7 +265,7 @@ public static function output() {
 	 */
 	private static function remove_log_file() {
 
-		if ( ! llms_verify_nonce( '_wpnonce', 'delete_log', 'GET' ) || ! current_user_can( 'manage_lifterlms' ) ) {
+		if ( ! isset( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'delete_log' ) || ! current_user_can( 'manage_lifterlms' ) ) {
 			wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
 		}
 
diff --git a/includes/admin/class.llms.admin.settings.php b/includes/admin/class.llms.admin.settings.php
@@ -88,7 +88,7 @@ public static function get_settings_tabs() {
 	public static function save() {
 
 		global $current_tab;
-		if ( isset( $_POST['_wpnonce'] ) && ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
+		if ( isset( $_POST['_wpnonce'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
 			die( esc_html__( 'Whoa! something went wrong there!. Please refresh the page and retry.', 'lifterlms' ) );
 		}
 
diff --git a/includes/admin/post-types/class.llms.meta.boxes.php b/includes/admin/post-types/class.llms.meta.boxes.php
@@ -285,7 +285,7 @@ public function validate_post( $post_id, $post ) {
 			return false;
 		} elseif ( defined( 'DOING_AUTOSAVE' ) || is_int( wp_is_post_revision( $post ) ) || is_int( wp_is_post_autosave( $post ) ) ) {
 			return false;
-		} elseif ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		} elseif ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return false;
 		} elseif ( empty( $_POST['post_ID'] ) || $_POST['post_ID'] != $post_id ) {
 			return false;
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.coupon.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.coupon.php
@@ -247,7 +247,10 @@ public function get_fields() {
 	 */
 	protected function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.course.options.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.course.options.php
@@ -574,7 +574,10 @@ function_exists( 'llms_blocks_is_post_migrated' ) && llms_blocks_is_post_migrate
 	 */
 	protected function save_before( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.engagement.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.engagement.php
@@ -251,7 +251,10 @@ public function get_fields() {
 	 */
 	public function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.membership.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.membership.php
@@ -375,7 +375,10 @@ public function get_fields() {
 	 */
 	public function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
+			return -1;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return -1;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.order.details.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.order.details.php
@@ -91,7 +91,10 @@ public function output() {
 	 */
 	public function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
+			return -1;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return -1;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.order.submit.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.order.submit.php
@@ -104,7 +104,10 @@ public function output() {
 	 */
 	public function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.order.transactions.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.order.transactions.php
@@ -121,7 +121,10 @@ private function resend_receipt( $post_id ) {
 	 */
 	public function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.visibility.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.visibility.php
@@ -92,7 +92,10 @@ public function output() {
 	 */
 	public function save( $post_id ) {
 
-		if ( ! llms_verify_nonce( 'llms_catalog_visibility_nonce', 'llms-catalog-visibility-nonce' ) ) {
+		if ( ! isset( $_REQUEST['llms_catalog_visibility_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_catalog_visibility_nonce'] ) ), 'llms-catalog-visibility-nonce' ) ) {
 			return;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.voucher.export.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.voucher.export.php
@@ -80,7 +80,7 @@ public static function output( $post ) {
 	 */
 	public static function export() {
 
-		if ( empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! llms_verify_nonce( 'lifterlms_export_nonce', 'lifterlms_csv_export_data' ) ) {
+		if ( empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! isset( $_REQUEST['lifterlms_export_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_export_nonce'] ) ), 'lifterlms_csv_export_data' ) ) {
 			return false;
 		}
 
diff --git a/includes/admin/post-types/meta-boxes/class.llms.meta.box.voucher.php b/includes/admin/post-types/meta-boxes/class.llms.meta.box.voucher.php
@@ -257,7 +257,7 @@ private function redemption_section_html() {
 	 */
 	public function save( $post_id ) {
 
-		if ( ! empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
+		if ( ! empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! isset( $_REQUEST['lifterlms_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
 			return false;
 		}
 
diff --git a/includes/admin/settings/class.llms.settings.checkout.php b/includes/admin/settings/class.llms.settings.checkout.php
@@ -404,7 +404,10 @@ private function get_settings_gateway( $curr_section ) {
 	 */
 	public function save() {
 
-		if ( ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
+		if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
 			return;
 		}
 
diff --git a/includes/admin/settings/class.llms.settings.notifications.php b/includes/admin/settings/class.llms.settings.notifications.php
@@ -242,7 +242,10 @@ public function merge_code_button() {
 	 */
 	public function before_save() {
 
-		if ( ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
+		if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
 			return;
 		}
 
@@ -266,7 +269,10 @@ public function before_save() {
 	 */
 	public function after_save() {
 
-		if ( ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
+		if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
 			return;
 		}
 
diff --git a/includes/class-llms-staging.php b/includes/class-llms-staging.php
@@ -84,7 +84,7 @@ public static function handle_staging_notice_actions() {
 			return;
 		}
 
-		if ( ! llms_verify_nonce( '_llms_staging_nonce', 'llms_staging_status', 'GET' ) || ! current_user_can( 'manage_options' ) ) {
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_llms_staging_nonce'] ) ), 'llms_staging_status' ) || ! current_user_can( 'manage_options' ) ) {
 			wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
 		}
 
diff --git a/includes/class.llms.install.php b/includes/class.llms.install.php
@@ -691,7 +691,7 @@ public static function update_actions() {
 			return;
 		}
 
-		if ( ! llms_verify_nonce( 'llms-db-update', 'do_db_updates', 'GET' ) ) {
+		if ( ! isset( $_REQUEST['llms-db-update'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms-db-update'] ) ), 'do_db_updates' ) ) {
 			wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
 		}
 
diff --git a/includes/class.llms.view.manager.php b/includes/class.llms.view.manager.php
@@ -220,7 +220,7 @@ public static function get_url( $role, $href = false, $args = array() ) {
 	 */
 	private function get_view() {
 
-		if ( ! llms_verify_nonce( 'view_nonce', 'llms-view-as', 'GET' ) ) {
+		if ( ! isset( $_REQUEST['view_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['view_nonce'] ) ), 'llms-view-as' ) ) {
 			return 'self';
 		}
 
diff --git a/includes/controllers/class-llms-controller-checkout.php b/includes/controllers/class-llms-controller-checkout.php
@@ -462,7 +462,10 @@ private function start_ajax( $method ) {
 	public function switch_payment_source() {
 
 		// Invalid nonce or the form wasn't submitted.
-		if ( ! llms_verify_nonce( '_switch_source_nonce', self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
+		if ( ! isset( $_REQUEST['_switch_source_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_switch_source_nonce'] ) ), self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
 			return;
 		}
 
@@ -490,7 +493,10 @@ public function switch_payment_source() {
 	public function switch_payment_source_ajax() {
 
 		// Invalid nonce or the form wasn't submitted.
-		if ( ! llms_verify_nonce( self::AJAX_QS_VAR, self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
+		if ( ! isset( $_REQUEST[ self::AJAX_QS_VAR ] ) ) {
+			return null;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ self::AJAX_QS_VAR ] ) ), self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
 			return null;
 		}
 
@@ -676,7 +682,10 @@ private function switch_payment_source_success( $args, $note = false ) {
 	 */
 	private function verify_request( $field, $nonce ) {
 
-		if ( ! llms_verify_nonce( $field, $nonce, 'POST' ) ) {
+		if ( ! isset( $_REQUEST[ $field ] ) ) {
+			return null;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ $field ] ) ), $nonce ) ) {
 			return null;
 		}
 
diff --git a/includes/controllers/class.llms.controller.achievements.php b/includes/controllers/class.llms.controller.achievements.php
@@ -88,7 +88,10 @@ protected function get_text( $text_type, $variables = array() ) {
 	 */
 	public function maybe_handle_reporting_actions() {
 
-		if ( ! llms_verify_nonce( '_llms_achievement_actions_nonce', 'llms-achievement-actions' ) ) {
+		if ( ! isset( $_REQUEST['_llms_achievement_actions_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_achievement_actions_nonce'] ) ), 'llms-achievement-actions' ) ) {
 			return;
 		}
 
diff --git a/includes/controllers/class.llms.controller.admin.quiz.attempts.php b/includes/controllers/class.llms.controller.admin.quiz.attempts.php
@@ -40,7 +40,10 @@ public function __construct() {
 	 */
 	public function maybe_run_actions() {
 
-		if ( ! llms_verify_nonce( '_llms_quiz_attempt_nonce', 'llms_quiz_attempt_actions', 'POST' ) ) {
+		if ( ! isset( $_REQUEST['_llms_quiz_attempt_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_quiz_attempt_nonce'] ) ), 'llms_quiz_attempt_actions' ) ) {
 			return;
 		}
 
diff --git a/includes/controllers/class.llms.controller.certificates.php b/includes/controllers/class.llms.controller.certificates.php
@@ -163,7 +163,10 @@ public function maybe_authenticate_export_generation() {
 	 * @return void
 	 */
 	public function maybe_handle_reporting_actions() {
-		if ( ! llms_verify_nonce( '_llms_cert_actions_nonce', 'llms-cert-actions' ) ) {
+		if ( ! isset( $_REQUEST['_llms_cert_actions_nonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_cert_actions_nonce'] ) ), 'llms-cert-actions' ) ) {
 			return;
 		}
 
diff --git a/includes/controllers/class.llms.controller.lesson.progression.php b/includes/controllers/class.llms.controller.lesson.progression.php
diff --git a/includes/controllers/class.llms.controller.quizzes.php b/includes/controllers/class.llms.controller.quizzes.php
diff --git a/includes/forms/controllers/class.llms.controller.account.php b/includes/forms/controllers/class.llms.controller.account.php
diff --git a/includes/forms/controllers/class.llms.controller.login.php b/includes/forms/controllers/class.llms.controller.login.php
diff --git a/includes/forms/controllers/class.llms.controller.registration.php b/includes/forms/controllers/class.llms.controller.registration.php
diff --git a/includes/llms.functions.core.php b/includes/llms.functions.core.php

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+significance: patch`
	`2`	`+type: changed`
	`3`	`+entry: Using standard WP nonce check functions instead of llms_verify_nonce.`
Original file line number	Diff line number	Diff line change
`@@ -466,7 +466,7 @@ public function register() {`
`466`	`466`	`*/`
`467`	`467`	`protected function save( $post_id ) {`
`468`	`468`
`469`		`- if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) \|\| ! current_user_can( $this->capability, $post_id ) ) {`
	`469`	`+ if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) \|\| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) \|\| ! current_user_can( $this->capability, $post_id ) ) {`
`470`	`470`	`return -1;`
`471`	`471`	`}`
`472`	`472`
Original file line number	Diff line number	Diff line change
`@@ -377,7 +377,7 @@ public function save(): ?WP_Error {`
`377`	`377`	`$nonce = "llms_{$this->id}_nonce";`
`378`	`378`	`$action = "llms_{$this->id}_save";`
`379`	`379`
`380`		`- if ( ! isset( $_POST[ $nonce ] ) \|\| ! llms_verify_nonce( $nonce, $action ) \|\| ! current_user_can( 'manage_lifterlms' ) ) {`
	`380`	`+ if ( ! isset( $_POST[ $nonce ] ) \|\| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST[ $nonce ] ) ), $action ) \|\| ! current_user_can( 'manage_lifterlms' ) ) {`
`381`	`381`	`return null;`
`382`	`382`	`}`
`383`	`383`
Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,7 @@ public function maybe_serve_export() {`
`45`	`45`	`}`
`46`	`46`
`47`	`47`	`// Verify nonce.`
`48`		`- if ( ! llms_verify_nonce( 'llms_dl_export_nonce', LLMS_Abstract_Exportable_Admin_Table::EXPORT_NONCE_ACTION, 'GET' ) ) {`
	`48`	`+ if ( ! isset( $_REQUEST['llms_dl_export_nonce'] ) \|\| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_dl_export_nonce'] ) ), LLMS_Abstract_Exportable_Admin_Table::EXPORT_NONCE_ACTION ) ) {`
`49`	`49`	`wp_die( esc_html__( 'Cheatin’ huh?', 'lifterlms' ) );`
`50`	`50`	`}`
`51`	`51`
Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,7 @@ public function admin_footer( $text ) {`
`123`	`123`	`*/`
`124`	`124`	`public function dismiss() {`
`125`	`125`
`126`		`- if ( ! current_user_can( 'manage_lifterlms' ) \|\| ! llms_verify_nonce( 'nonce', 'llms-admin-review-request-dismiss' ) ) {`
	`126`	`+ if ( ! current_user_can( 'manage_lifterlms' ) \|\| ! isset( $_REQUEST['nonce'] ) \|\| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'llms-admin-review-request-dismiss' ) ) {`
`127`	`127`	`wp_die();`
`128`	`128`	`}`
`129`	`129`
Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ public function add_help_tabs() {`
`81`	`81`	`*/`
`82`	`82`	`public function cloud_import() {`
`83`	`83`
`84`		`- if ( ! llms_verify_nonce( 'llms_cloud_importer_nonce', 'llms-cloud-importer' ) \|\| ! current_user_can( 'manage_lifterlms' ) ) {`
	`84`	`+ if ( ! isset( $_REQUEST['llms_cloud_importer_nonce'] ) \|\| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_cloud_importer_nonce'] ) ), 'llms-cloud-importer' ) \|\| ! current_user_can( 'manage_lifterlms' ) ) {`
`85`	`85`	`return false;`
`86`	`86`	`}`
`87`	`87`
`@@ -277,7 +277,7 @@ protected function show_error( $error ) {`
`277`	`277`	`*/`
`278`	`278`	`public function upload_import() {`
`279`	`279`
`280`		`- if ( ! llms_verify_nonce( 'llms_importer_nonce', 'llms-importer' ) \|\| ! current_user_can( 'manage_lifterlms' ) \|\| empty( $_FILES['llms_import'] ) ) {`
	`280`	`+ if ( ! isset( $_REQUEST['llms_importer_nonce'] ) \|\| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_importer_nonce'] ) ), 'llms-importer' ) \|\| ! current_user_can( 'manage_lifterlms' ) \|\| empty( $_FILES['llms_import'] ) ) {`
`281`	`281`	`return false;`
`282`	`282`	`}`
`283`	`283`
Original file line number	Diff line number	Diff line change
`@@ -246,7 +246,7 @@ public static function has_notice( $notice_id ) {`
`246`	`246`	`*/`
`247`	`247`	`public static function hide_notices() {`
`248`	`248`	`if ( ( isset( $_GET['llms-hide-notice'] ) \|\| isset( $_GET['llms-remind-notice'] ) ) && isset( $_GET['_llms_notice_nonce'] ) ) {`
`249`		`- if ( ! llms_verify_nonce( '_llms_notice_nonce', 'llms_hide_notices_nonce', 'GET' ) ) {`
	`249`	`+ if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_llms_notice_nonce'] ) ), 'llms_hide_notices_nonce' ) ) {`
`250`	`250`	`wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );`
`251`	`251`	`}`
`252`	`252`	`if ( ! current_user_can( 'manage_options' ) ) {`