wp-activate.php use unfilter value in database query

[alifamoorzadeh]

hello
in file "wp-activate.php" lines:

86: $key = !empty($_GET['key']) ? $_GET['key'] : $_POST['key'];
87: $result = wpmu_activate_signup( $key );

passed user input value to wpmu_activate_signup function without filter then this function use value in db query.

[ocean90]

Hello @alifamoorzadeh, thanks for the report.

In wpmu_activate_signup() the$key value gets escaped in tags/4.4.1/src/wp-includes/ms-functions.php#L955​ through the use of $wpdb->prepare() (​code ref), means we don't use unfiltered values in the query.

Since this report was about a potential security issue please keep this mind:

Do not report potential security vulnerabilities here.
See the ​Security FAQ and contact security@wordpress.org.