WP_Site::__set() and WP_Network::__set() allow to set any property without a way to retrieve it

[ocean90]

Noticed while working on #40458.

The magic setters of WP_Site and WP_Network allow to set any property via $this->$key = $value; but neither __set() nor __isset() can handle custom properties. Not sure if they should or if we should just block any non-default properties.

[MaximeCulea]

Hi @bor0,
We talked about this issue in the ticket-scrub.

By default, as a __set() method hasn't been created, when you set a non-existing property, it becomes public, so it can be accessed afterwards.

So now, as it hasn't been "block" in WP_Post, because WP_Post::__set() doesn't exists, the question is why we would implement it for WP_Site and WP_Network ?

Moreover and more generally, what did you expect about blocking non-existing property creation ?

Patch avenue :
If we wanna digg into this, we would have to remove the $this->$key = $value in the __set() method.