// client-dashboard.php line 25
public function init() {
    $user_id    = get_current_user_id();
    $refresh_cd = get_user_meta( $user_id, 'it-sync-refresh-cd' );

    // If this user is supposed to see the client dashboard
    if ( get_user_meta( $user_id, 'ithemes-sync-client-dashboard', true ) && empty( $refresh_cd ) ) {
        // ...
        // Filter menu items
        add_action( 'admin_menu', [ $this, 'filter_admin_menu' ], 999999 ); // We want to be last!
        // ...
    } else {
        // If this is a call from the Edit User screen in sync, clear the cache.
        if ( ! empty( $refresh_cd ) ) {
            delete_user_meta( $user_id, 'it-sync-refresh-cd' );
            $this->clear_cache();
        }
    }
}

---

// src/Admin_Post/Admin_Post_Handler.php (inferred based on load.php and research plan)
// The handler for 'it-sync-refresh-client-dashboard' fails to perform a capability check
// like current_user_can( 'manage_options' ) before setting the 'it-sync-refresh-cd' meta key.

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/ithemes-sync/3.2.8/client-dashboard.php /home/deploy/wp-safety.org/data/plugin-versions/ithemes-sync/3.2.9/client-dashboard.php
--- /home/deploy/wp-safety.org/data/plugin-versions/ithemes-sync/3.2.8/client-dashboard.php	2024-09-18 19:06:28.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/ithemes-sync/3.2.9/client-dashboard.php	2026-02-18 19:29:54.000000000 +0000
@@ -330,7 +330,7 @@
 			[
 				'blog_id' => get_current_blog_id(),
 				'fields'  => [ 'ID' ],
-			] 
+			]
 		);
 		$meta_key = 'ithemes-sync-admin-bar-items-' . get_current_blog_id();
 		foreach ( $users as $user ) {
@@ -352,7 +352,7 @@
 				[
 					'blog_id' => 0,
 					'fields'  => [ 'ID' ],
-				] 
+				]
 			);
 			foreach ( $wpdb->get_col( $query ) as $blog_id ) {
 				delete_blog_option( $blog_id, 'ithemes-sync-admin_menu' );
@@ -366,22 +366,49 @@
 		}
 	}
 
-	public function dashboard_admin_footer() {
+	public function dashboard_admin_footer(): void {
+		global $wp_meta_boxes;
+
 		$meta_box_list = get_option( 'ithemes-sync-dashboard-metaboxes' );
-		if ( false === $meta_box_list ) {
-			global $wp_meta_boxes;
-			$screen        = get_current_screen();
-			$meta_box_list = [];
-			foreach ( $wp_meta_boxes[ $screen->id ] as $box_position ) {
-				foreach ( $box_position as $box_set ) {
-					foreach ( $box_set as $box ) {
-						$meta_box_list[ $box['id'] ] = $box['title'];
+		if ( is_array( $meta_box_list ) ) {
+			return;
+		}
+
+		$screen = get_current_screen();
+		if ( ! $screen instanceof WP_Screen ) {
+			return;
+		}
+
+		if ( $screen->id !== 'dashboard' ) {
+			return;
+		}
+
+		$screen_meta_boxes = (array) ( $wp_meta_boxes[ $screen->id ] ?? [] );
+		$meta_box_list     = [];
+		foreach ( $screen_meta_boxes as $box_position ) {
+			if ( ! is_array( $box_position ) ) {
+				continue;
+			}
+
+			foreach ( $box_position as $box_set ) {
+				if ( ! is_array( $box_set ) ) {
+					continue;
+				}
+
+				foreach ( $box_set as $box ) {
+					$id    = (string) ( $box['id'] ?? '' );
+					$title = (string) ( $box['title'] ?? '' );
+					if ( $id === '' || $title === '' ) {
+						continue;
 					}
+
+					$meta_box_list[ $id ] = $title;
 				}
 			}
-			$meta_box_list['show_welcome_panel'] = _x( 'Welcome', 'Welcome panel' );
-			update_option( 'ithemes-sync-dashboard-metaboxes', $meta_box_list );
 		}
+
+		$meta_box_list['show_welcome_panel'] = _x( 'Welcome', 'Welcome panel' );
+		update_option( 'ithemes-sync-dashboard-metaboxes', $meta_box_list );
 	}