Login Security module breaks multi-site user management

We’ve encountered a problem with the Wordfence plugin in a medium-sized multi-site installation. Our admins are not able to manage site users because memory is exhausted and a fatal error thrown when simply clicking to the WordPress “Manage Users” page.

It doesn’t matter how high the memory limit we set, the page will eventually timeout when trying to list users who manage several sites in the network because of something that’s happening in the “2FA Status” column that your plugin adds to the list table.

Through debugging, we’ve tracked the culprit down to your Controller_Permissions::get_all_roles method. The ostensible purpose of this method is to retrieve the super-set of roles for a user. (It’s called by Contoller_Users::does_user_role_require_2fa to determine whether these roles require 2FA.) The problem with the approach here seems to be that your methodology which calls “switch_to_blog”, “new \WP_User”, and “restore_current_blog” repeatedly is causing some sort of memory leak or is otherwise too inefficient a way to calculate its result.

May we propose revisiting this method to do something much faster and more direct, e.g. querying all the values in the usermeta table matching “%_capabilities” or cycling through the get_blogs_of_user blog IDs to fetch the roles directly from the usermeta table?

Here’s an example that is working great for us:

foreach (get_blogs_of_user($user->ID) as $id => $blog) {
	$blog_roles_meta_key = $wpdb->get_blog_prefix($id) . "capabilities";
	$blog_roles = maybe_unserialize($wpdb->get_var("
		SELECT meta_value
		FROM {$wpdb->usermeta}
		WHERE user_id = '{$user->ID}'
		AND meta_key = '$blog_roles_meta_key'
	"));
	if (is_array($blog_roles))
		$roles = array_merge($roles, array_keys($blog_roles));
}