wp_lostpassword_url() duplicates the base path on a Multisite network installed in a subdirectory

[youcune]

On a Multisite network installed in a subdirectory, wp_lostpassword_url() returns a URL where the base path appears twice.

This happens when the network base path is not "/". For example, when WordPress is installed at ​http://example.com/subdir/ , the base path is "/subdir/".

Steps to reproduce

1. Install a fresh copy of WordPress in a subdirectory, for example ​http://example.com/subdir/ .
2. Enable Multisite by following the official guide "Create A Network": ​https://wordpress.org/support/article/create-a-network/
3. Open the "Lost your password?" link on the login page.

Reproduced on a clean install with no plugins, using only the steps in the official Create A Network guide.

Tested on WordPress 7.0.2 with no plugins active.

What I expected

http://example.com/subdir/wp-login.php?action=lostpassword

What actually happens

http://example.com/subdir/subdir/wp-login.php?action=lostpassword

The "/subdir/" part is repeated.

Why it happens

In wp_lostpassword_url() (wp-includes/general-template.php), the code adds the current site's path in front of "wp-login.php":

$blog_details  = get_site();
$wp_login_path = $blog_details->path . 'wp-login.php';
...
$lostpassword_url = add_query_arg( $args, network_site_url( $wp_login_path, 'login' ) );

The value of $blog_details->path (the wp_blogs.path column) already includes the base path. For the main site it is the same as the network path.

Then network_site_url() adds the network base path in front again. So the base path is added two times, and you get "/subdir/subdir/".

wp_login_url() and wp_registration_url() do not have this problem. They use site_url() and do not add the path a second time.

The line that prepends $blog_details->path was added in WordPress 5.5 (#39311).

On a Multisite network installed in a subdirectory (e.g. http://example.com/subdir/), wp_lostpassword_url() returns a URL with the base path duplicated, such as http://example.com/subdir/subdir/wp-login.php?action=lostpassword. This happens because network_site_url() already prepends the network's base path ($current_network->path) to the given path, but wp_lostpassword_url() was separately prepending the current site's own path ($blog_details->path) in front of wp-login.php before handing it to network_site_url(). For the main site of a subdirectory network, and more generally for any site whose path is nested under a non-root network path, this results in the base path being added twice. This fix strips the network's base path from the site's path before it's appended, since network_site_url() adds that prefix back on its own — matching how the per-site path handling introduced in #39311 was intended to work. Two tests were added covering both the main site of a subdirectory network (where the site path and network path are identical) and a subsite nested under a non-root network path, confirming the duplicate segment is gone in both cases while the existing subsite-at-root-network case (the original #39311 fix) continues to resolve correctly.

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5
Used for: Root-cause analysis, implementation, and tests. Reviewed by Igor Rozum.