Changeset 14802

Timestamp:

04/10/2026 04:06:06 AM (5 weeks ago)

Author:

dd32

Message:

Bad Requests: Don't report logged out requests from pentesters with invalid cookie values.

File:

• sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php

@@ -310 +310 @@
         'production' === wp_get_environment_type() &&
         function_exists( 'wporg_error_reporter' ) &&
-        ! empty( $_COOKIE['wporg_logged_in'] )
+        (
+            // If we've loaded WordPress, use the validated cookie value, otherwise, cookie being present.
+            did_action( 'init' ) ?
+                is_user_logged_in() :
+                ! empty( $_COOKIE['wporg_logged_in'] )
+        )
     ) {
         wporg_error_reporter( E_USER_NOTICE, "400 Bad Request: $reference", __FILE__, __LINE__ );