6 ms·

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa60d98bd5a048b603402e70209c https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String c

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa60d98bd5a048b603402e70209c https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

dinkelberg 2mo ago
What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?
- reddalo 2mo ago
  WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.
  - mewpmewp2 2mo ago
    That could as well just be a complete new product then, right? It would definitely be a breaking change and unmigratable.
  - sourcecodeplz 2mo ago
    Who is they? automaticc?
  - mapmeld 2mo ago
    A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/ https://blog.cloudflare.com/emdash-wordpress/
    - mkl 2mo ago
      TypeScript, not Rust.
  - pluc 2mo ago
    Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.
    - deleted 2mo ago
      [deleted]
  - dncornholio 2mo ago
    Impossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.
- Yokohiii 2mo ago
  To construct dynamic sql queries to have to string concatenate at least some parts, . User data should of course be passed via prepared statements.
  - formerly_proven 2mo ago
    Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.
    - winstonwinston 2mo ago
      Quick search shows this in Wordpress: > WordPress database access abstraction class. class wpdb {} So this is some sort of ORM provided. $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT ); > Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below. It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.
      - codedokode 2mo ago
        It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.
  - codedokode 2mo ago
    One usually uses "query builder" pattern for that. Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.
9dev 2mo ago
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
- geek_at 2mo ago
  it would help if they used strict types and modern standards but as you say the wordpress codebase is beyond dated and held together with duckt tape
- asimovDev 2mo ago
  As a junior I am glad I happened to start working with PHP on version 7. I had some peeks at our legacy PHP5 stuff (all killed now thankfully) and it looked very different. I am sure it would suck to work with.
  - thejosh 2mo ago
    php7 was such a great time period for PHP, honestly lots of great experimental projects around that time too (HHVM before that, etc).
    - mschuster91 2mo ago
      PHP 8 is good too. Lots of syntactic sugar to make your life so, so much easier.
- khalic 2mo ago
  I remember multiple projects giving up on rewriting it. Maybe a machine with endless patience could do it?
  - hparadiz 2mo ago
    I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.
sunaookami 2mo ago
Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with-plugins/ https://developer.wordpress.org/plugins/creating-tables-with... >Rather than executing an SQL query directly, we’ll use the dbDelta function >Note that the dbDelta function is rather picky, however. For instance: >You must put each field on its own line in your SQL statement. >You must have two spaces between the words PRIMARY KEY and the definition of your primary key. >You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY. >KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis. >You must not use any apostrophes or backticks around field names. >Field types must be all lowercase. >SQL keywords, like CREATE TABLE and UPDATE, must be uppercase. >You must specify the length of all fields that accept a length parameter. int(11), for example.
- madaxe_again 2mo ago
  I like that you chose ten examples. >> s/you must/thou shalt/g
- duped 2mo ago
  Sometimes when you write documentation for APIs you realize something is terribly designed. That should have happened here.
m00dy 2mo ago
>>Principal Software Engineer @ Bluehost. WordPress Core Committer. Baseball fan. hmm yes, definitely. You are the principal.
SpikedCola 2mo ago
Ahhh very interesting! Thanks for pointing this out, I saw an attack against one of our sites this weekend using this exploit. > data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...

dinkelberg 2mo ago

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?

reddalo 2mo ago
WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.
- mewpmewp2 2mo ago
  That could as well just be a complete new product then, right? It would definitely be a breaking change and unmigratable.
- sourcecodeplz 2mo ago
  Who is they? automaticc?
- mapmeld 2mo ago
  A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/ https://blog.cloudflare.com/emdash-wordpress/
  - mkl 2mo ago
    TypeScript, not Rust.
- pluc 2mo ago
  Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.
  - deleted 2mo ago
    [deleted]
- dncornholio 2mo ago
  Impossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.
Yokohiii 2mo ago
To construct dynamic sql queries to have to string concatenate at least some parts, . User data should of course be passed via prepared statements.
- formerly_proven 2mo ago
  Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.
  - winstonwinston 2mo ago
    Quick search shows this in Wordpress: > WordPress database access abstraction class. class wpdb {} So this is some sort of ORM provided. $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT ); > Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below. It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.
    - codedokode 2mo ago
      It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.
- codedokode 2mo ago
  One usually uses "query builder" pattern for that. Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

9dev 2mo ago

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

geek_at 2mo ago
it would help if they used strict types and modern standards but as you say the wordpress codebase is beyond dated and held together with duckt tape
asimovDev 2mo ago
As a junior I am glad I happened to start working with PHP on version 7. I had some peeks at our legacy PHP5 stuff (all killed now thankfully) and it looked very different. I am sure it would suck to work with.
- thejosh 2mo ago
  php7 was such a great time period for PHP, honestly lots of great experimental projects around that time too (HHVM before that, etc).
  - mschuster91 2mo ago
    PHP 8 is good too. Lots of syntactic sugar to make your life so, so much easier.
khalic 2mo ago
I remember multiple projects giving up on rewriting it. Maybe a machine with endless patience could do it?
- hparadiz 2mo ago
  I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.

sunaookami 2mo ago

Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with-plugins/ https://developer.wordpress.org/plugins/creating-tables-with... >Rather than executing an SQL query directly, we’ll use the dbDelta function >Note that the dbDelta function is rather picky, however. For instance: >You must put each field on its own line in your SQL statement. >You must have two spaces between the words PRIMARY KEY and the definition of your primary key. >You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY. >KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis. >You must not use any apostrophes or backticks around field names. >Field types must be all lowercase. >SQL keywords, like CREATE TABLE and UPDATE, must be uppercase. >You must specify the length of all fields that accept a length parameter. int(11), for example.

madaxe_again 2mo ago
I like that you chose ten examples. >> s/you must/thou shalt/g
duped 2mo ago
Sometimes when you write documentation for APIs you realize something is terribly designed. That should have happened here.

m00dy 2mo ago

>>Principal Software Engineer @ Bluehost. WordPress Core Committer. Baseball fan. hmm yes, definitely. You are the principal.

SpikedCola 2mo ago

Ahhh very interesting! Thanks for pointing this out, I saw an attack against one of our sites this weekend using this exploit. > data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...