Reviewing files that changed from the base of the PR and between 7dd0ef9 and d21a60b.

• core/Permissions/Create_Users.php
• core/Permissions/List_Users.php
• routes/user.php

core/Permissions/Create_Users.php (1)

13-34: Permission logic is correct and appropriately restrictive.

The implementation correctly enforces that only users with the create_users capability (typically administrators) can create users. The asymmetry with List_Users (which also allows PM managers) appears intentional—user creation is a more privileged operation than listing.

The 401/403 distinction for unauthenticated vs. unauthorized access follows REST API best practices.

Please confirm this asymmetry is intentional: PM managers can list users but cannot create them. If PM managers should also be able to create users, add the wedevs_pm_user_can_access() check as done in List_Users.php.

core/Permissions/List_Users.php (1)

13-39: Well-structured permission check with appropriate dual-path authorization.

The implementation correctly provides two authorization paths:

1. WordPress core list_users capability (typically admins)
2. PM-specific manager capability via wedevs_pm_user_can_access()

This ensures both WordPress administrators and PM managers can access user listing endpoints while blocking lower-privileged users like subscribers—directly addressing the IDOR vulnerability.

routes/user.php (2)

7-15: Security fix correctly applied to all user listing endpoints.

All GET endpoints for user data are now properly protected with List_Users permission, closing the IDOR vulnerability.

One consideration: GET users/{id} now requires list_users capability. Verify whether users should be able to view their own profile data. If self-access is a valid use case, the List_Users permission class may need an additional check:

// Allow users to view their own data
if ( $this->request->get_param('id') == $user_id ) {
    return true;
}

---

17-19: User creation endpoint properly secured.

The POST users endpoint is now protected with Create_Users permission, preventing unauthorized user creation.