From fae47c6065ce07e9a8b44501002fa5b4f16d2456 Mon Sep 17 00:00:00 2001
From: Mykyta Synelnikov <nsinelnikov.work@gmail.com>
Date: Thu, 29 Jun 2023 19:56:54 +0300
Subject: [PATCH] - fixed vulnerability if wp_capabilities has accent
 characters;

---
 includes/core/class-user.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/core/class-user.php b/includes/core/class-user.php
index b5986933..926433e5 100644
--- a/includes/core/class-user.php
+++ b/includes/core/class-user.php
@@ -178,7 +178,7 @@ if ( ! class_exists( 'um\core\User' ) ) {
 		public function is_metakey_banned( $meta_key ) {
 			$is_banned = false;
 			foreach ( $this->banned_keys as $ban ) {
-				if ( is_numeric( $meta_key ) || false !== stripos( $meta_key, $ban ) ) {
+				if ( is_numeric( $meta_key ) || false !== stripos( $meta_key, $ban ) || false !== stripos( remove_accents( $meta_key ), $ban ) ) {
 					$is_banned = true;
 					break;
 				}