slabbi

I understand. Thank you for the feedback.

I have quite a few plugins installed on my website, but I haven’t seen this syntax before.

The vulnerability is now two days old, and there’s still no response from VG WORT.

@”VG WORT”: If you can’t – or don’t want to – fix the bug, then put the source code on Github and give interested users access to it for further development.

• This reply was modified 9 months, 2 weeks ago by slabbi.

$post_id = (int) $_POST['post_id'];

the value is always cast to an integer. When the value of post_id cannot be converted to an integer it is “0”, so I doubt that this is a problem here. Same for the second value. The only unchecked values are the identification IDs.

Fix:

Replace:

add_filter(‘the_title’, ‘filter_sdm_post_type_title’, 10, 2);
function filter_sdm_post_type_title($title, $id) {

with

add_filter(‘the_title’, ‘filter_sdm_post_type_title’, 10, 2);
function filter_sdm_post_type_title($title, $id = null) {

See the notes here:

https://developer.ww.wp.xz.cn/reference/hooks/the_title/