WordPress 7.0 allows spaces in usernames

[santiko86]

Issue: WordPress 7.0 accepts usernames with spaces, which should be rejected.

Steps to reproduce:

1. Go to Users → Add New
2. Enter username with spaces: k a l i
3. Save the user
4. WordPress accepts it

Expected behavior:
Username should be rejected or automatically trimmed of spaces

Actual behavior:
Multiple users created with spaces: k a l i, K A L I, ka l i

Environment:

• WordPress 7.0
• Default theme (no plugins)
• No custom code

Issue: Usernames with spaces break author URLs and create duplicates

POC: ​https://drive.google.com/drive/folders/1PecXgSMHaagMhxjM_dK78_TlH2vWkYBP?usp=sharing

Proposed Fixed

1. Reject username with space

In /wp-includes/user.php or /wp-admin/user-new.php, add validation:

// Validate username - no spaces allowed
if ( preg_match( '/\s/', $username ) ) {
    wp_die( __( 'Usernames cannot contain spaces.' ) );
}

or

2. Trimmed all spaces

// Remove spaces from username before saving
$username = trim( str_replace( ' ', '', $username ) );

[santiko86]

This is POC video.

[Presskopp]

Duplicate of #44690.

There has been some discussion:

See #49395, #59084