Changeset 65378

Timestamp:

11/10/2026 08:18:14 AM (15 hours ago)

Author:

whyisjake

Message:

Security: Let the secrets.php drop-in set plain variables.

wp_load_secrets_dropin() requires wp-content/secrets.php inside a function, so a drop-in that set an override as a plain variable, such as $wp_secrets_keyring = new My_Keyring();, only set a local variable. The override was ignored and the default was used instead, with nothing to say so.

The $wp_secrets_provider, $wp_secrets_store and $wp_secrets_keyring globals are now declared before the drop-in is required, as require_wp_db() does with $wpdb for db.php. Drop-ins that write to $GLOBALS work as before.

Follow-up to r64337.

Props ericmann, jorbin.
See #66187.

File:

• trunk/src/wp-includes/load.php (modified) (2 diffs)

trunk/src/wp-includes/load.php

@@ -832 +832 @@
  * classes implement already exists and every plugin sees the drop-in's provider.
  *
+ * The drop-in sets its overrides in the `$wp_secrets_provider`, `$wp_secrets_store`
+ * and `$wp_secrets_keyring` globals. They are declared global before the require, so
+ * a plain assignment such as `$wp_secrets_keyring = new My_Keyring();` works.
+ *
  * Sets `$GLOBALS['wp_secrets_dropin_loaded']` as soon as the file is found, whether
  * or not it then loads cleanly: wp_using_secrets_dropin() reports presence, not
@@ -873 +877 @@
 
         $GLOBALS['wp_secrets_dropin_loaded'] = true;
+
+        /*
+         * The drop-in is required inside this function. Declaring the overrides global
+         * lets it set them as plain variables, as db.php does with $wpdb.
+         */
+        global $wp_secrets_provider, $wp_secrets_store, $wp_secrets_keyring;
 
         try {