Fatal error in wp_insert_term() when the term name is not a string

[josephscott]

An XML-RPC wp.newPost request with a terms_names entry that is an array instead of a string ends in a fatal error:

curl -i -H 'Content-Type: text/xml' http://localhost:8889/xmlrpc.php \
--data '<?xml version="1.0"?><methodCall><methodName>wp.newPost</methodName><params><param><value><int>1</int></value></param><param><value><string>admin</string></value></param><param><value><string>password</string></value></param><param><value><struct><member><name>post_title</name><value><string>Nested term name</string></value></member><member><name>terms_names</name><value><struct><member><name>post_tag</name><value><array><data><value><array><data><value><string>foo</string></value></data></array></value></data></array></value></member></struct></value></member></struct></value></param></params></methodCall>'

The terms_names loop in _insert_post() does not check the type of each term name. get_term_by( 'name', $array, $taxonomy ) casts the value to a string and returns false, so the code goes on to create the term:

<?php
$term_info = wp_insert_term( $term_name, $taxonomy );

wp_insert_term() then runs '' === trim( $term ). That causes PHP to throw a TypeError for an array, so instead of an XML-RPC fault the client gets an HTTP 500.

Two things need to change:

1. wp_insert_term() should return the existing empty_term_name WP_Error for a non-scalar $term. This covers every caller, including wp.newTerm, the REST terms controller, and plugins. Numeric term names keep working as they do today.
2. The terms_names loop in _insert_post() should reject anything that is not a string with an IXR_Error, matching the Invalid term ID. check for terms by ID right above it.

I will have a PR to address both of those items.

https://core.trac.wordpress.org/ticket/66108

AI assistance: Yes
Tool(s): Claude Code
Model(s): Fable 5.1
Used for: Research and experimentation. Guided directions on writing the code changes. It wrote the tests.

[westonruter]

As I just ​commented on your PR for #66107, I think we should start adopting JSON Schema for the XML-RPC methods, and use REST API functions for sanitization and validation. This will greatly simplify the logic in the methods, as there won't need to be many isset and type check guards all over the place.