If you have encountered a security issue A security issue is a type of bug that can affect the security of WordPress installations. Specifically, it is a report of a bug that you have found in the WordPress core code, and that you have determined can be used to gain some level of access to a site running WordPress that you should not have. that isn’t addressed in a released version of WordPress, please report it to the WordPress HackerOne program. For more, see our Security FAQ in the handbook.
Recent posts on the make/core Core is the set of software required to run WordPress. The Core Development Team builds WordPress. blog (versus network, site)
View all posts tagged security.
75 open tickets in the Security component
75 open tickets. Last 7 days: +1 ticket Created for both bug reports and feature development on the bug tracker.
13 tickets that have no replies
View list on Trac
- #43215 Allow wp_kses to pass allowed CSS Cascading Style Sheets. properties
- #51611 Escape echoing Core functions
- #52333 Lack of the : entity on the list of allowed entity names in kses.php
- #52388 Use HTTPS HTTPS is an acronym for Hyper Text Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. This is especially helpful for protecting sensitive data like banking information. URL A specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org already during installation if supported
- #53296 Do trim $hook_name within add_action() and add_filter() function
- #53994 REST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) https://developer.wordpress.org/rest-api/. requests with session cookies but an invalid A resolution on the bug tracker (and generally common in software development, sometimes also notabug) that indicates the ticket is not a bug, is a support request, or is generally invalid./missing nonce are considered authenticated for most of the request rest-api
- #54280 wp_verify_nonce should return a filter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output.
- #54512 Suggestion for file protection privacy
- #56785 Automatically catch potential security issues before release
- #56860 Sodium Compat library is improperly loaded
- #57424 Specific hook for Content Security Policy
- #57447 wp_ajax_inline_save function does not check if post has "public" or "show_ui" enabled
75 open tickets
Open enhancements: 36 View list on Trac
Open tasks: 1 View list on Trac
Open feature requests: 11 View list on Trac
Help maintain this component
Many contributors help maintain one or more components. These maintainers are vital to keeping WordPress development running as smoothly as possible. They triage The act of evaluating and sorting bug reports, in order to decide priority, severity, and other factors. new tickets, look after existing ones, spearhead or mentor tasks, pitch new ideas, curate roadmaps, and provide feedback to other contributors. Longtime maintainers with a deep understanding of particular areas of Core are always seeking to mentor others to impart their knowledge.
Want to help? Start following this component! Adjust your notifications here. Feel free to dig into any ticket.
Contributors following this component: