Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wordpress/wordpress-coding-standards
develop @ f72bcdf
2
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
WordPress/Sniffs/Security/NonceVerificationSniff.php: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Code Injection: eval() was used to determine falsy values, allowing malicious version parameters to execute arbitrary code. The fix removed eval() entirely, indicating the sink is high-risk and must never be reintroduced.
Auth Bypass: Sanitization was previously accepted as an alternative to nonce verification, allowing attackers to bypass authentication checks. The fix mandates nonce checks, so any path that skips nonce validation in favor of sanitization is a vulnerability.