Patch PHP Privilege Escalation vulnerability

patch-code-sample-privilege-escalation.php

<?php

  if (!isset($phone_number) && isset($email) && filter_var($email, FILTER_VALIDATE_EMAIL)) {
      $ID = email_exists($email);
  }

  $current_user_id = get_current_user_id();
  if($current_user_id!==$ID){
      die ('user id not same!');	
  }

  $user = get_user_by('ID', $ID);	

  $password = sanitize_text_field($_GET['password']);
  if ($user) {
      wp_update_user([
          'ID' => $user->ID,
          'user_pass' => $password
      ]);
      update_user_meta($user->ID, 'updatedPass', 1);
      echo json_encode([
          'success' => true,
          'message' => __('Password set successfully! redirecting...', 'login-with-phone-number')
      ]);

      die();
  } else {

      echo json_encode([
          'success' => false,
          'message' => __('User not found', 'login-with-phone-number')
      ]);

      die();
  }