Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Automattic/wp-calypso

              trunk @ f627fd1
            

Fixes

CVEs

HIGH

Peak severity

24.3%

Coverage

Highlights

Open Redirect: 18 prior fixes. Scrutinize any change in this area.

.github/workflows/pr-review.yml: most-fixed (4 issues). Treat as high-risk during review.

50 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Open Redirect: Multiple open redirect fixes across login and OAuth flows indicate a systemic weakness in validating redirect targets, often allowing external or javascript: URLs.

Auth Bypass: Route guards and access checks were repeatedly missing or bypassable, allowing unauthorized access to restricted dashboard and agency pages.

Auth Bypass: OAuth and Apple login flows lacked state validation, enabling login CSRF and session fixation attacks.