Background Problem

The site I'm working right now uses custom front-end forms for content, terms and user editing and creation. Access to wp-admin is blocked for non administrator.

All of them uses basic wp_ajax functionality.

On the user editing form, the function updates the user data using wp_update_user() and saves the meta field using update_user_meta().

Just now i found out that one of the saved meta field is saved to another user ID (mine, administrator) by someone else.

The code wasn't changed because it works, even after I updated the overwritten user meta, using the same function.


Here is the stripped code that saves the meta field.

add_action('wp_ajax_edit-author', 'process_edit_author');

function process_edit_author() {

global $current_user;
if ( empty($_POST) || !wp_verify_nonce($_POST[$current_user->user_login],'edit-author') ) {
    echo 'You targeted the right function, but sorry, your nonce did not verify.';
} else {

    $profile_upload = $_FILES['profile-picture'];

    if ($profile_upload['name'][0]) {
        $profile_picture = attach_uploads($profile_upload);
        update_user_meta( $current_user->ID, 'profile-picture', $profile_picture[0]);



The attach_uploads() saves the uploaded file as attachment. The first file attachment ID then is saved to the user meta.


So far I can only tell that the image is uploaded by someone else's account, because the author of the attachment is not me.

Need Help

Does anyone have found this problem? Where and how should I debug this problem? How can I prevent this to happen again?

Thank you in advance .

1 Answer 1


That's likely because you are using $current_user->ID, which always refers to the currently logged in user, or when "empty" object if not logged in (ID == 0). If you would like to update user meta on any other user you would have to supply the user ID of that user in the $_POST data as well.

  • Thank you @Simon, but I'm not really sure about it, especially since the function actually works (almost all the time that is).
    – ifdion
    Feb 28, 2013 at 17:39
  • Yes, it will work as long as you are not editing users other than yourself. See this note in the wp_get_current_user () documentation, it says ID is 0 when the user is not logged in. Perhaps other functions will temporarily overwrite the $current_user (though I doubt it). I would recommend you use a function such as get_userdata() instead and store user ID's as needed by your forms/update methods.
    – Simon
    Feb 28, 2013 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.