Security: add a CSRF nonce to the setup/installer AJAX action

.github/workflows/e2e.yml

@@ -520,7 +520,12 @@ jobs:
 
       - name: Fix permissions for Cypress output
         if: always()
-        run: sudo chown -R $USER:$USER tests/e2e/cypress
+        run: |
+          if [ -d tests/e2e/cypress ]; then
+            sudo chown -R $USER:$USER tests/e2e/cypress
+          else
+            echo "Cypress output directory not found; skipping permission fix."
+          fi
 
       - name: Upload Cypress screenshots
         if: always()
@@ -540,4 +545,9 @@ jobs:
 
       - name: Stop WordPress Environment
         if: always()
-        run: npm run env:stop
+        run: |
+          if [ -f package.json ]; then
+            npm run env:stop
+          else
+            echo "package.json not found; skipping WordPress environment stop."
+          fi

assets/js/setup-wizard.js

@@ -104,6 +104,7 @@
 						action: wu_setup_settings.ajax_action || 'wu_setup_install',
 						installer: content,
 						'dry-run': wu_setup_settings.dry_run,
+						_wpnonce: wu_setup_settings.install_nonce,
 					},
 					success(data) {
 

inc/admin-pages/class-multisite-setup-admin-page.php

@@ -96,7 +96,7 @@
 	 * @return string Title of the page.
 	 */
 	public function get_title(): string {
 		return __('Enable WordPress Multisite', 'multisite-ultimate');
 	}
 
 	/**
@@ -106,7 +106,7 @@
 	 * @return string Menu label of the page.
 	 */
 	public function get_menu_title() {
 		return __('Multisite Ultimate', 'multisite-ultimate');
 	}
 
 	/**
@@ -129,22 +129,22 @@
 
 		return [
 			'welcome'   => [
 				'title'      => __('Multisite Required', 'multisite-ultimate'),
 				'next_label' => __('Get Started →', 'multisite-ultimate'),
 				'back'       => false,
 				'view'       => [$this, 'section_welcome'],
 			],
 			'configure' => [
 				'title'       => __('Network Configuration', 'multisite-ultimate'),
 				'description' => __('Configure your network settings. These settings determine how your sites will be structured.', 'multisite-ultimate'),
 				'next_label'  => __('Continue →', 'multisite-ultimate'),
 				'handler'     => [$this, 'handle_configure'],
 				'fields'      => [$this, 'get_network_configuration_fields'],
 				'back'        => true,
 			],
 			'install'   => [
 				'title'        => __('Installing Network', 'multisite-ultimate'),
 				'description'  => __('Setting up your WordPress Multisite network...', 'multisite-ultimate'),
 				'next_label'   => Core_Installer::get_instance()->all_done() ? __('Begin Ultimate Multisite Setup →', 'ultimate-multisite') : __('Install', 'ultimate-multisite'),
 				'disable_next' => true,
 				'handler'      => [$this, 'handle_install_complete'],
@@ -157,7 +157,7 @@
 				],
 			],
 			'complete'  => [
 				'title'       => __('Setup Complete', 'multisite-ultimate'),
 				'description' => __('WordPress Multisite setup is now complete!', 'multisite-ultimate'),
 				'view'        => [$this, 'section_complete'],
 				'back'        => false,
@@ -508,6 +508,12 @@
 			exit;
 		}
 
+		if ( ! check_ajax_referer('wu_setup_install', '_wpnonce', false)) {
+			wp_send_json_error(new \WP_Error('bad-nonce', __('Security check failed. Please reload the page and try again.', 'ultimate-multisite')));
+
+			exit;
+		}
+
 		$installer                   = wu_request('installer', '');
 		$multisite_network_installer = Multisite_Network_Installer::get_instance();
 		$steps                       = $multisite_network_installer->get_steps();

inc/admin-pages/class-setup-wizard-admin-page.php

@@ -269,6 +269,12 @@ public function setup_install(): void {
 			exit;
 		}
 
+		if ( ! check_ajax_referer('wu_setup_install', '_wpnonce', false)) {
+			wp_send_json_error(new \WP_Error('bad-nonce', __('Security check failed. Please reload the page and try again.', 'ultimate-multisite')));
+
+			exit;
+		}
+
 		/*
 		 * Load tables.
 		 */

inc/admin-pages/class-wizard-admin-page.php

@@ -516,6 +516,7 @@ public function render_installation_steps($steps, $checks = true) {
 			'wu_setup_settings',
 			[
 				'dry_run'               => wu_request('dry-run', true),
+				'install_nonce'         => wp_create_nonce('wu_setup_install'),
 				'generic_error_message' => __('A server error happened while processing this item.', 'ultimate-multisite'),
 			]
 		);