Changeset 63677

Timestamp:

09/17/2026 05:57:46 PM (less than one hour ago)

Author:

desrosj

Message:

XML-RPC: Reject writes to internal-only builtin post types.

Merges r63660 to the 7.1 branch.

Props xknown, westonruter, jorbin, johnbillion.

Location:

branches/7.1

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

branches/7.1/src/wp-includes/class-wp-xmlrpc-server.php

@@ -1463 +1463 @@
                 }
 
+                // Reject writes to internal-only builtin post types (e.g. customize_changeset)
+                // whose intended write path is a dedicated helper, not a generic post API.
+                $is_internal_only = (
+                        empty( $post_type->public )
+                        && empty( $post_type->show_in_rest )
+                        && ! empty( $post_type->_builtin )
+                );
+
+                /**
+                 * Filters whether a post type accepts writes via XML-RPC.
+                 *
+                 * Defaults to false for internal-only builtin post types (public=false,
+                 * show_in_rest=false, _builtin=true), such as customize_changeset, whose
+                 * writes are meant to flow through dedicated helpers. Return true to opt
+                 * a post type back in.
+                 *
+                 * @since 7.1.1
+                 *
+                 * @param bool         $allowed   Whether the post type accepts XML-RPC writes.
+                 * @param WP_Post_Type $post_type The post type object.
+                 */
+                $allowed = apply_filters( 'xmlrpc_allow_post_type_writes', ! $is_internal_only, $post_type );
+
+                if ( ! $allowed ) {
+                        return new IXR_Error( 403, __( 'Sorry, this post type is not supported over XML-RPC.' ) );
+                }
+
                 $update = ! empty( $post_data['ID'] );