I am using loops as means of displaying personal meta and customer information on the frontend.
For example, I have a page which displays a user's 'profile' information to edit. Their profile is custom post type that was created when the registered. The loop for the edit screen finds the one cpt based on the current user id, populates the form fields, and after submission updates the post. Is this secure?
If not what some better ways to handle this type of action?
*--Edited to include example code
Here is a sample loop. This is pulling in a vendor's items they sell. The GF hooks pre-populate the form in the middle with the meta from the product, after submission the post is updated.
<?php
$q = new WP_Query( array( 'author' => $current_user->ID, 'post_type' => 'product' ) );
if ( $q->have_posts() ) {
while ( $q->have_posts() ) {
$q->the_post( ); ?>
<div id="<?php the_id(); ?>" class="tab_content_trip" style="display:none;">
<?php echo do_shortcode('[gravityform id="7" title="false" description="false" ajax="true"]'); ?>
</div>
<?php }
wp_reset_postdata();
} ?>
So my question is if it is possible for someone to somehow hijack a loop like this and edit other users posts in some way? (of course not including if they somehow steal their password, or something of that nature)
Essentially, I am seeking some insight on best practice for securely filtering user information to be displayed on the frontend
