Ticket #24030: 24030-1.patch

src/wp-includes/pluggable.php

@@ -1681 +1681 @@
         $i = wp_nonce_tick();
 
         // Nonce generated 0-12 hours ago
-        if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
+        if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce ) {
                 return 1;
         // Nonce generated 12-24 hours ago
-        if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
+  } elseif ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce ) {
                 return 2;
-        // Invalid nonce
-        return false;
+  } else {
+    /**
+     * Fires when nonce verification fails.
+     *
+     * @since 3.9.2
+     *
+     * @param int    $uid    ID of the nonce-owning user.
+     * @param string $action The nonce action.
+     */
+    do_action( 'wp_verify_nonce_failed', $uid, $action );
+    // Invalid nonce
+    return false;
+  }
 }
 endif;