Commit 21856c1d0f for wordpress.org

commit 21856c1d0f584fd3b90a0a33b72a8944c6493101
Author: gziolo <gziolo@git.wordpress.org>
Date:   Fri Oct 30 11:20:53 2026 +0000

    Abilities API: Restrict content-query author visibility to viewable post types

    Prevent pagination totals from revealing author slugs through non-viewable post types. Add regression coverage.

    Developed in https://github.com/WordPress/wordpress-develop/pull/15181.

    Follow-up to [64688].

    Props gziolo, laurisaarni, jorgefilipecosta, sadmansakibnadvi.
    See #66268.


    Built from https://develop.svn.wordpress.org/trunk@65045


    git-svn-id: http://core.svn.wordpress.org/trunk@64195 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/abilities/class-wp-abilities-content.php b/wp-includes/abilities/class-wp-abilities-content.php
index 28e03177dd..6be7e065e0 100644
--- a/wp-includes/abilities/class-wp-abilities-content.php
+++ b/wp-includes/abilities/class-wp-abilities-content.php
@@ -1336,10 +1336,10 @@ final class WP_Abilities_Content {
 	 * Returns a user when the current user may see them as an author.
 	 *
 	 * The current user may see themselves, the users they can edit, every user when they can
-	 * list users, and otherwise the authors of posts they can read in a post type exposed to
-	 * abilities: this ability returns those posts with their author, so the author is already
-	 * in view. Which post types the REST API exposes plays no part. A user the current user
-	 * may not see is reported like a missing one.
+	 * list users, and otherwise the authors of posts they can read in a publicly viewable post
+	 * type exposed to abilities: this ability returns those posts with their author, so the
+	 * author is already in view. Which post types the REST API exposes plays no part. A user
+	 * the current user may not see is reported like a missing one.
 	 *
 	 * The `author` field and the `author` slug filter share this rule, so the filter never
 	 * confirms a slug the field withholds. The post count is kept per author for the query,
@@ -1361,7 +1361,7 @@ final class WP_Abilities_Content {
 		}

 		if ( ! isset( $this->visible_authors[ $user_id ] ) ) {
-			$post_types                        = get_post_types( array( 'show_in_abilities' => true ), 'names' );
+			$post_types                        = array_values( array_filter( get_post_types( array( 'show_in_abilities' => true ), 'names' ), 'is_post_type_viewable' ) );
 			$this->visible_authors[ $user_id ] = (int) count_user_posts( $user_id, $post_types ) > 0;
 		}

diff --git a/wp-includes/version.php b/wp-includes/version.php
index c9ae58e037..29aa6dd443 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta3-65044';
+$wp_version = '7.2-beta3-65045';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.