Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

WordPress/wordpress-playground

              trunk @ 3144994
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

SSRF: 3 prior fixes. Scrutinize any change in this area.

packages/playground/website/public/plugin-proxy.php: most-fixed (2 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Two separate fixes to the same proxy component indicate a recurring SSRF risk from URL parameters and redirect handling. The first added host allowlist validation on redirects, the second added branch name allowlisting for a new parameter, showing the attack surface grows with each new feature.

SSRF: The CORS proxy had a self-SSRF vector allowing it to target its own host, which could bypass existing SSRF defenses and amplify requests. The fix rejects target hosts matching HTTP_HOST or SERVER_ADDR, but sibling proxy paths may not enforce the same self-referential check.

Credential Exposure / Auth Bypass: CI workflows embedded a GitHub token in git remote URLs, exposing credentials to any workflow runner. The fix replaced this with SSH deploy keys, but other workflow files may still use similar patterns with different secrets.