Warning logged if wp-login.php action is given as an array

[leedxw]

An attacker has caused a warning to be logged by providing an array for the login action

PHP Warning:  Array to string conversion in /var/www/html/wp-login.php on line 509

To reproduce

curl -F user_login=x "http://localhost/wp-login.php?action[]=lostpassword"

Suggested patch

--- wp-login.php.dist	2025-05-12 09:44:24.926044462 +0000
+++ wp-login.php	2025-05-12 09:51:03.969310149 +0000
@@ -480,5 +480,5 @@
  */
 
-$action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : 'login';
+$action = ( isset( $_REQUEST['action'] ) && is_string ( $_REQUEST['action'] ) ) ? $_REQUEST['action'] : 'login';
 $errors = new WP_Error();
 

[SergeyBiryukov]

In 60239:

Login and Registration: Check that action is a string in wp-login.php.

This prevents a PHP warning if an array is passed instead.

Follow-up to [1974], [6643], [6711], [41782], [58023], [58093].

Props leedxw, dilipbheda.
Fixes #63434.