Ticket #30210: 30210.4.patch

src/wp-includes/functions.php

@@ -1204 +1204 @@
 function do_feed() {
         global $wp_query;
 
+        /*
+         * Check the queried object for the existence of posts if it is not a feed for an archive
+         * or search result. By checking for the absense of posts we can prevent rendering the feed
+         * templates at invalid endpoints. e.g.) /wp-content/plugins/feed/
+         */
+        if ( ! $wp_query->have_posts() && ! ( $wp_query->is_archive() || $wp_query->is_post_type_archive() || $wp_query->is_search() ) ) {
+                wp_die( __( 'ERROR: This is not a valid feed.' ), '', array( 'response' => 404 ) );
+        }
+
         $feed = get_query_var( 'feed' );
 
         // Remove the pad, if present.