Accessing /wp-admin/admin-post.php?page=font-library while logged loads Site Editor

[slaFFik]

Hey there,

When you try to load this page wp-admin/admin-post.php?page=font-library for any WordPress site (while being logged out), you can get various errors. That may be PHP warnings, or partially loaded Site Editor and its Font Editor interface.

Examples:

• ​https://wordpress.com/wp-admin/admin-post.php?page=font-library
• ​https://wordpress.tv/wp-admin/admin-post.php?page=font-library
• ​https://www.taylorswift.com/wp-admin/admin-post.php?page=font-library
• ​https://magazine.atavist.com/wp-admin/admin-post.php?page=font-library&p=54656

etc.

This also understandably generates a bunch of console errors in the browser.

Depending on how plugins have been coded, they may expose some admin-specific information in the HTML of the page (because they may output JSON, including some putting various keys there).

Similar behavior with some other pages, like this one: /wp-admin/admin-post.php?page=options-connectors

[ShameemReza]

Reproduction report. Confirmed on a clean trunk install with no plugins active.

Environment

• WordPress: 7.2-alpha-63166-src (trunk, local Docker environment)
• PHP: 8.3.33
• No plugins, default theme.

Steps

1. Log out, or use a fresh browser session with no cookies.
2. Request /wp-admin/admin-post.php?page=font-library.

Results

The response is HTTP 200 with about 21 KB of rendered HTML: the font library app container, block editor scripts, module preloads for the font-list and fonts-home routes, and REST preload data. A PHP deprecation notice from wp-admin/includes/plugin.php:2156 also leaks into the page title. A request to admin-post.php without the page parameter returns an empty body as expected.

Cause

wp_font_library_intercept_render() in wp-includes/build/pages/font-library/page.php is hooked to admin_init and renders the full page whenever $_GET['page'] equals font-library, then exits. It has no capability check, while the menu registration in wp-admin/menu.php gates the Fonts page behind edit_theme_options. Since admin-post.php fires admin_init for logged-out requests to support admin_post_nopriv_ actions, the interceptor runs for anonymous visitors on an endpoint it was never meant to handle. The generated options-connectors page uses the same pattern, which matches the second example in the description.

These files are generated by the Gutenberg build and copied into core during the build step, so the fix needs to land in the generator in the Gutenberg repository rather than in wp-includes/build/. The guard itself would be a capability check matching the menu registration, plus limiting the interceptor to its own screen instead of every admin_init.

[ShameemReza]

It's a Gutenberg related issue, so I've gone ahead and created one here: ​https://github.com/WordPress/gutenberg/issues/82251

[adrianduffell]

Gutenberg PR is now merged and added to the 7.1.1 backport PR.

​Gutenberg PR
​Backport PR