From b4b0bb99060cc5f69fce4d62eec7386264a84860 Mon Sep 17 00:00:00 2001
From: David Cavins <david.cavins@gmail.com>
Date: Mon, 6 Jul 2026 14:24:45 -0500
Subject: [PATCH] Components: Restrict updates to site admins (0.7 branch).

Ensure that the current user has the `manage_options` capability before allowing them to change BuddyPress component status.

Special thanks to kasthelord (Lukas Collishaw) who first reported this issue responsibly.

Props emaralive, jjj, renato, kasthelord (Lukas Collishaw), 1353594865qq, jeromewincek (Jerome Wincek), vvh1te3zz.
Special thanks to kasthelord (Lukas Collishaw) who first reported this issue responsibly.

Props emaralive, jjj, renato, kasthelord (Lukas Collishaw), 1353594865qq, jeromewincek (Jerome Wincek), vvh1te3zz.
---
 .../class-bp-rest-components-endpoint.php     | 13 ++++++++-
 .../testcases/components/test-controller.php  | 28 +++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/includes/bp-components/classes/class-bp-rest-components-endpoint.php b/includes/bp-components/classes/class-bp-rest-components-endpoint.php
index 713cd6dd..03416922 100644
--- a/includes/bp-components/classes/class-bp-rest-components-endpoint.php
+++ b/includes/bp-components/classes/class-bp-rest-components-endpoint.php
@@ -271,7 +271,18 @@ public function update_item( $request ) {
 	 * @return true|WP_Error
 	 */
 	public function update_item_permissions_check( $request ) {
-		$retval = $this->get_items_permissions_check( $request );
+		$retval = new WP_Error(
+			'bp_rest_authorization_required',
+			__( 'Sorry, you are not allowed to perform this action.', 'buddypress' ),
+			array(
+				'status' => rest_authorization_required_code(),
+			)
+		);
+
+		// Unlike `get_items`, toggling a component is an admin-only operation.
+		if ( bp_current_user_can( 'manage_options' ) ) {
+			$retval = true;
+		}
 
 		/**
 		 * Filter the components `update_item` permissions check.
diff --git a/tests/testcases/components/test-controller.php b/tests/testcases/components/test-controller.php
index 983ec8fe..ed4863e6 100644
--- a/tests/testcases/components/test-controller.php
+++ b/tests/testcases/components/test-controller.php
@@ -341,6 +341,34 @@ public function test_update_item_without_permission() {
 		$this->assertErrorResponse( 'bp_rest_authorization_required', $response, 403 );
 	}
 
+	/**
+	 * @group update_item
+	 */
+	public function test_update_item_site_admin_only() {
+		$u = static::factory()->user->create(
+			array(
+				'role' => 'author',
+			)
+		);
+
+		$this->bp::set_current_user( $u );
+
+		// Snapshot so we can prove no component was toggled.
+		$before = bp_get_option( 'bp-active-components' );
+
+		$request = new WP_REST_Request( 'PUT', $this->endpoint_url );
+		$request->set_query_params( array(
+			'name'   => 'friends',
+			'action' => 'deactivate',
+		) );
+		$response = $this->server->dispatch( $request );
+
+		$this->assertErrorResponse( 'bp_rest_authorization_required', $response, 403 );
+
+		// The component toggle must not have executed.
+		$this->assertSame( $before, bp_get_option( 'bp-active-components' ) );
+	}
+
 	/**
 	 * @group delete_item
 	 */