Bug: Users list table dies (wp_die) when a user's only 2FA provider has been deregistered

[masteradhoc]

Describe the bug

Summary

If an admin removes a 2FA provider from the registered provider list (e.g. via a two_factor_providers filter) while a user still has that provider as their only enabled method, the wp-admin Users list table fatals mid-render via wp_die(). This truncates the page and breaks other admin UI (e.g. Screen Options stops responding).

See https://wordpress.org/support/topic/truncated-users-list-when-previous-2fa-method-unavailable/

Root cause

get_available_providers_for_user() returns a WP_Error when a user's enabled provider no longer exists and Email isn't available as a fallback:

} else {
    return new WP_Error( 'no_available_2fa_methods', ... );
}

get_primary_provider_for_user() then calls wp_die() on that error:

} elseif ( is_wp_error( $available_providers ) ) {
    wp_die( $available_providers );
}

This is invoked per-row from manage_users_custom_column() while rendering the Users list table, so one user's stale data kills the whole admin page for anyone viewing it.

Expected behavior

A single user's invalid/legacy 2FA state should never be able to wp_die() the Users list table. The row should show a graceful status (e.g. "legacy/unavailable method") instead.

Suggested fix

• Remove the wp_die() call from get_primary_provider_for_user(); return null/WP_Error instead and let callers handle it.
• In manage_users_custom_column(), check for null/WP_Error before calling ->get_label() and render a safe fallback string.
• Audit other callers of get_primary_provider_for_user() for the same unguarded assumption.

Steps to Reproduce

1. Have a user enable Email as their only 2FA method.
2. Remove Two_Factor_Email from the registered providers (filter out two_factor_providers).
3. Visit wp-admin → Users.
4. Page output truncates when the table reaches that user's row.

Screenshots, screen recording, code snippet

No response

Environment information

No response

Please confirm that you have searched existing issues in this repository.

Yes

Please confirm that you have tested with all plugins deactivated except Two-Factor.

Yes