Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wordpress/wordpress-develop

              trunk @ 712a6af
            

248

Fixes

100

CVEs

CRITICAL

Peak severity

10.8%

Coverage

Highlights

Auth Bypass: 47 prior fixes. Scrutinize any change in this area.

wp-includes/functions.php: most-fixed (13 issues). Treat as high-risk during review.

67 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: The database abstraction layer historically allowed query syntax manipulation via unsafe string formatting, nested prepare calls, and incomplete identifier escaping. Developers should enforce parameterized query building using safe helpers and the dedicated %i placeholder.

Cross-Site Scripting (XSS): HTML sanitization bypasses consistently recur within the KSES subsystem due to entity decoding anomalies, faulty regular expression filters, and unhandled bogus comment states. Standardizing on the spec-compliant HTML API and performing aggressive entity normalization before validation are crucial.

Path Traversal: Weak path sanitization on Windows-based environments led to directory traversal and unauthorized file deletions. Using robust path canonicalization, normalizing backslashes, and performing explicit prefix checks against the destination directory are mandatory to prevent path boundaries breakout.