From 0e7832e3caa880975ed9d0698556905a6a7f1a64 Mon Sep 17 00:00:00 2001 From: Volodymyr Kolesnykov Date: Sat, 21 Feb 2026 14:52:24 +0200 Subject: [PATCH] fix(totp): delete user TOTP key after disabling the provider --- providers/class-two-factor-totp.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/providers/class-two-factor-totp.php b/providers/class-two-factor-totp.php index d458d990..ea6b8a2f 100644 --- a/providers/class-two-factor-totp.php +++ b/providers/class-two-factor-totp.php @@ -175,12 +175,12 @@ public function rest_delete_totp( $request ) { $user_id = $request['user_id']; $user = get_user_by( 'id', $user_id ); - $this->delete_user_totp_key( $user_id ); - if ( ! Two_Factor_Core::disable_provider_for_user( $user_id, 'Two_Factor_Totp' ) ) { return new WP_Error( 'db_error', __( 'Unable to disable TOTP provider for this user.', 'two-factor' ), array( 'status' => 500 ) ); } + $this->delete_user_totp_key( $user_id ); + ob_start(); $this->user_two_factor_options( $user ); $html = ob_get_clean();