Non-numeric attachment_id and p query string params result in posts page

[timbarkerse]

We've had a very thorough security review done on our site and the reviewer flagged up that giving a non-numeric parameter to p or attachment_id parameters: e.g.

site.com/?p=c or
site.com/?attachment_id=c

returns the posts page of the site. I would expect the 404 page. This behaviour returns the posts page even when we don't want this page to be visible on the site i.e. when the front page is set to a static page and we show the posts in other ways.

I have tested it on a clean install of the latest version of WP with no plugins.

[timbarkerse]

NB: empty attachment_id e.g.
site.com/?attachment_id=

also results in the same behaviour

[SergeyBiryukov]

Hi there, welcome to WordPress Trac! Thanks for the report.

Just linking to some related tickets here: #17737, #33372.