Race condition in WordPress 7.1 Block Editor: Adding custom field to auto-draft causes duplicated postmeta and forces comment_status to closed

[stanleychan]

In WordPress 7.1, a race condition occurs when adding a custom field (via the legacy Custom Fields meta box) to a newly created post (auto-draft status) before its initial save or publish. This results in two critical issues:

• The custom field is inserted twice in the wp_postmeta table.
• The comment_status is incorrectly forced to closed, regardless of the site's default settings.

Steps to Reproduce

1. Go to Posts > Add New Post to open the Block Editor (creating an auto-draft).
2. Ensure the legacy "Custom Fields" panel is enabled.
3. Before saving as a draft or publishing, immediately add a new custom field and value.
4. Click Publish or Save Draft.
5. Check the post metadata and discussion settings.

Expected Behavior

• The custom field should be saved only once.
• The post's comment_status should inherit the site's default setting (usually open).

Actual Behavior

• The custom field is duplicated (two identical key-value pairs in wp_postmeta).
• The comment_status changes to closed.

[ShameemReza]

I could reproduce both issues on a clean WordPress 7.1 install (wp-env, no plugins, default theme), and this is not actually a race condition. One click of "Add Custom Field" on an auto-draft triggers both, every time, before the post is even saved.

Clicking that button fires an add-meta AJAX request. Since the post is still an auto-draft, wp_ajax_add_meta() promotes it to a draft by calling edit_post() with a minimal $post_data array. Two things go wrong inside that call:

1. edit_post() unconditionally calls add_meta( $post_id ) near the end, and add_meta() reads metakeyinput / metavalue straight from $_POST. The AJAX request body contains exactly those fields, so the meta is inserted a first time. Control then returns to wp_ajax_add_meta(), which calls add_meta() itself. That's the second insert. Both rows exist in wp_postmeta before you click Save draft or Publish.
2. The $post_data array passed to edit_post() contains no comment_status or ping_status, so _wp_translate_postdata() defaults both to closed. That logic exists to handle unchecked checkboxes on the full edit form, but here it runs against a request that never had those checkboxes.

Database state right after the AJAX call, with the editor still showing an unsaved auto-draft:

post_status: draft   comment_status: closed   ping_status: closed
meta_id 4  trac66016_key  trac66016_value
meta_id 6  trac66016_key  trac66016_value

The classic editor has the same behavior at AJAX time. I verified with the Classic Editor plugin: identical duplicate rows and closed statuses appear the moment the field is added. The difference is that publishing from the classic editor submits the full form, including the pre-checked discussion checkboxes, so comment_status flips back to open on save. The block editor saves over the REST API and only sends comment_status if you touched the Discussion panel, so the closed value sticks. The duplicate rows survive in both editors. The classic UI only lists the second row, which is why this went unnoticed.

This is also not new in 7.1. The auto-draft branch of wp_ajax_add_meta() has been in place since at least 2014, so Version on this ticket mostly reflects where it was first noticed.

Related: ticket:11465 tracks the form-submit flavor of custom field duplication (Preview then Publish without clicking Add). attachment:11465.4.diff:ticket:11465​ on that ticket works around the same double add inside wp_ajax_add_meta() by unsetting the meta keys from $_POST, but it doesn't address the comment status side.

A cleaner fix for both symptoms at once: in the auto-draft branch, promote the post with wp_update_post() directly instead of going through edit_post(). The post keeps its existing comment and ping status, nothing reads the meta fields out of $_POST a second time, and the explicit add_meta() call becomes the only insert.

I'll put together a PR against the GitHub mirror with unit tests covering both cases.

Adding a custom field to a new post (auto-draft) through the legacy Custom Fields meta box inserts the meta twice and switches the post's comment and ping status to closed.

wp_ajax_add_meta() promotes the auto-draft to a draft through edit_post(). That function reads metakeyinput and metavalue from $_POST, which the AJAX request body contains, so the meta is added there first. Control then returns to wp_ajax_add_meta(), which calls add_meta() again. The same edit_post() call passes no comment_status or ping_status, so _wp_translate_postdata() defaults both to closed. The block editor only sends comment_status over the REST API when the Discussion panel was changed, so the closed status sticks after publishing.

This change promotes the auto-draft with wp_update_post() instead. The meta is inserted exactly once, the post keeps its comment and ping status, and the _edit_last meta is still set as before.

Includes unit tests covering both symptoms. They fail against the current code and pass with this change:

1) test_adding_meta_to_an_auto_draft_should_not_duplicate_the_meta
Failed asserting that two arrays are identical.
 Array &0 (
     0 => 'testvalue'
+    1 => 'testvalue'
 )

2) test_adding_meta_to_an_auto_draft_should_not_change_the_comment_and_ping_status
The comment status of the post should not have changed.
-'open'
+'closed'

To reproduce manually: on a clean install with the Custom Fields panel enabled, open Posts > Add New, add a custom field before saving, then check wp_postmeta and the post's comment_status.

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Used for: diagnosis, draft patch, and test suggestions. I reviewed, tested, and edited the final change.