Fatal errors in user lists

Resolved Michael
(@eizzumdm)

1 year ago

We are currently evaluating the free version of Wordfence, and we have encountered a serious blocker. There are some users in the Users page in the WordPress admin dashboard that trigger a fatal error when Wordfence is active. This happens on both the Network Users page and site-specific User pages. The critical error message also appears on the user-edit page.

TBH, we would love to completely disable the 2FA feature of Wordfence. We exclusively use SSO for our multisite network, which has its own MFA system, and the

[05-May-2025 20:11:25 UTC] PHP Fatal error: Uncaught TypeError: array_key_exists(): Argument #2 ($array) must be of type array, null given in /code/wp-content/plugins/wordfence/modules/login-security/classes/controller/permissions.php:440
Stack trace: 0 /code/wp-content/plugins/wordfence/modules/login-security/classes/controller/permissions.php(440): array_key_exists(‘subscriber’, NULL) 1 /code/wp-content/plugins/wordfence/modules/login-security/classes/controller/users.php(195): WordfenceLS\Controller_Permissions->does_user_have_multisite_capability(Object(WP_User), ‘wf2fa_activate_…’) 2 /code/wp-content/plugins/wordfence/modules/login-security/classes/controller/users.php(660): WordfenceLS\Controller_Users->can_activate_2fa(Object(WP_User)) 3 /code/wp-includes/class-wp-hook.php(324): WordfenceLS\Controller_Users->_user_row_actions(Array, Object(WP_User)) 4 /code/wp-includes/plugin.php(205): WP_Hook->apply_filters(Array, Array) 5 /code/wp-admin/includes/class-wp-ms-users-list-table.php(563): apply_filters(‘ms_user_row_act…’, Array, Object(WP_User)) 6 /code/wp-admin/includes/class-wp-list-table.php(1798): WP_MS_Users_List_Table->handle_row_actions(Object(WP_User), ‘username’, ‘username’) 7 /code/wp-admin/includes/class-wp-ms-users-list-table.php(506): WP_List_Table->single_row_columns(Object(WP_User)) 8 /code/wp-admin/includes/class-wp-list-table.php(1712): WP_MS_Users_List_Table->display_rows() 9 /code/wp-admin/includes/class-wp-list-table.php(1639): WP_List_Table->display_rows_or_placeholder() 10 /code/wp-admin/network/users.php(316): WP_List_Table->display() 11 {main}

thrown in /code/wp-content/plugins/wordfence/modules/loginsecurity/classes/controller/permissions.php on line 440

Viewing 3 replies - 1 through 3 (of 3 total)

Plugin Support wfpeter
(@wfpeter)

1 year ago

Hi @eizzumdm, thank-you for letting us know.

I have seen a similar error with other files before, caused by unexpected data from another plugin, which we were able to resolve. If you are able, seeing whether disabling a specific plugin related to editing users suppresses the error (while Wordfence remains active) could help us narrow it down, since we haven’t heard about it from other customers.

So that we can see the platform, and plugins in-use please could you send a site diagnostic to wftest @ wordfence . com directly from the link at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here again after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,
Peter.

Thread Starter Michael
(@eizzumdm)

1 year ago

Thank you, @wfpeter. I sent that diagnostic report as user eizzumdm.

I think the problem is in the user_roles table for one particular site because of an old plugin we no longer use. The capabilities array is empty for two roles (wpseo_manager and wpseo_editor). I am trying to fix the database to remove those old roles, but I am still having trouble. I may end up re-creating the problematic site.

It might be useful if permissions.php in Wordfence could recover more gracefully from that error.

Thread Starter Michael
(@eizzumdm)

1 year ago

I ended up recreating the site with the problematic user roles array and then deleted the original site. So there are no longer any empty arrays for Wordfence to trip over in line 440 of permissions.php.

Now that we have Wordfence Premium, we will submit a feature request to allow completely disabling Wordfence’s 2FA feature. We have disabled it for all roles but Super Admin.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Fatal errors in user lists’ is closed to new replies.