Change History (43)
This ticket was mentioned in PR #8134 on WordPress/wordpress-develop by @desrosj.
18 months ago
#1
@skithund commented on PR #8134:
18 months ago
#2
Cybertrust Global Root has also expired in 2021-12-15
#4
@
18 months ago
The attached PR removes the following legacy certificates:
- Cybertrust Global Root - 2021-12-15
- Thawte Server CA - 2020-12-31
- Thawte Premium Server CA - 2020-12-31
@johnbillion commented on PR #8134:
18 months ago
#8
Recommending that this is closed in favour of #8137.
18 months ago
#9
Recommending that this is closed in favour of #8137.
Works for me. My initial thinking was to separate the build process and the actual update of the certificates. But don't feel strongly about that at all.
#12
@
17 months ago
- Resolution fixed
- Status closed → reopened
Looks like there is a 1.5.6 update available.
This ticket was mentioned in PR #8489 on WordPress/wordpress-develop by @desrosj.
17 months ago
#13
Trac ticket: https://core.trac.wordpress.org/ticket/62811
This ticket was mentioned in PR #12023 on WordPress/wordpress-develop by XananasX7.
7 weeks ago
#43
## Summary
Multiple unserialize() call sites in WordPress core pass no allowed_classes option, allowing PHP gadget-chain attacks (PHP Object Injection / POI) if an attacker can influence the serialized data. This PR adds allowed_classes => false to every call site where only scalar/array data is expected, and defense-in-depth to all HMAC-validated widget deserialization paths.
## Files Changed
### src/wp-includes/functions.php — maybe_unserialize()
This is the most impactful change. maybe_unserialize() is called in hundreds of places throughout WordPress core to decode option values (wp_options), user meta, post meta, and widget settings from the database. The stored values are always scalars, arrays, or simple objects — never complex class instances with destructors or magic methods. Passing allowed_classes => false prevents any gadget-chain exploitation without any functional change.
### Widget unserialize paths (4 files)
src/wp-includes/blocks/legacy-widget.phpsrc/wp-includes/rest-api/endpoints/class-wp-rest-widgets-controller.phpsrc/wp-includes/rest-api/endpoints/class-wp-rest-widget-types-controller.phpsrc/wp-includes/class-wp-customize-widgets.php
All four already validate the serialized data via wp_hash() / HMAC before deserializing. Defense-in-depth still applies: if a server-side key compromise or hash collision were exploited, allowed_classes => false provides a second layer. Widget instances are always plain array values.
### SimplePie cache backends (5 files)
src/wp-includes/SimplePie/src/Cache/Redis.phpsrc/wp-includes/SimplePie/src/Cache/Memcache.phpsrc/wp-includes/SimplePie/src/Cache/Memcached.phpsrc/wp-includes/SimplePie/src/Cache/File.phpsrc/wp-includes/SimplePie/src/Cache/MySQL.php
SimplePie stores RSS/Atom feed data as nested arrays of strings and integers — no PHP class instances. An attacker with write access to the Redis/Memcache/filesystem cache could inject a serialized gadget chain. allowed_classes => false closes this attack path on all five backends.
## Risk Without This Fix
PHP Object Injection via unserialize() is a well-documented RCE vector. WordPress's autoloader makes thousands of classes available at deserialization time, including many with __destruct() and __wakeup() methods that can be chained into arbitrary code execution (similar to exploits against Magento, Drupal, and Joomla in prior CVEs).
## Compatibility
allowed_classes => false causes unserialize() to return an __PHP_Incomplete_Class stub instead of instantiating unexpected classes. Since no call site in this PR is expected to produce PHP objects, there is no functional change for any legitimate WordPress installation or plugin. The only breakage would be a plugin that stores serialized class instances in a widget setting — an undocumented and unsupported pattern.
## References
- https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
- PHP
unserialize()allowed_classesoption: https://www.php.net/manual/en/function.unserialize.php - Google Open Source Security / Patch Rewards Program
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
This updates the bundled root certificates that ship with WordPress Core by syncing the latest upstream changes from Mozilla as of December 31, 2024.
This also removes several expired legacy certificates that were included for backwards compatibility.
Trac ticket: https://core.trac.wordpress.org/ticket/62811