Commit c08a040ad6 for wordpress.org

commit c08a040ad69e6f580ad856912b23bc85673ebb63
Author: westonruter <westonruter@git.wordpress.org>
Date:   Thu Oct 29 01:03:00 2026 +0000

    Privacy: Avoid PHP warnings for invalid request IDs.

    When the checks in `wp_validate_user_request_key()` were consolidated in r49090, the `confirm_key` and `modified_timestamp` properties came to be read before the request was confirmed to exist. A confirmation link whose `request_id` is not a `user_request` post, as is common with bot probes of `wp-login.php?action=confirmaction`, therefore logged two "Attempt to read property on false" warnings before returning the `invalid_request` error. The error is now returned as soon as the lookup fails, so the returned errors are unchanged.

    Developed in https://github.com/WordPress/wordpress-develop/pull/14991.
    Follow-up to r49090.

    Props bor0.
    See #51351.
    Fixes #66389.

    Built from https://develop.svn.wordpress.org/trunk@64997


    git-svn-id: http://core.svn.wordpress.org/trunk@64147 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/user.php b/wp-includes/user.php
index e1030ee025..915020f21e 100644
--- a/wp-includes/user.php
+++ b/wp-includes/user.php
@@ -5126,12 +5126,17 @@ function wp_validate_user_request_key(
 	#[\SensitiveParameter]
 	$key
 ) {
-	$request_id       = absint( $request_id );
-	$request          = wp_get_user_request( $request_id );
+	$request_id = absint( $request_id );
+	$request    = wp_get_user_request( $request_id );
+
+	if ( ! $request ) {
+		return new WP_Error( 'invalid_request', __( 'Invalid personal data request.' ) );
+	}
+
 	$saved_key        = $request->confirm_key;
 	$key_request_time = $request->modified_timestamp;

-	if ( ! $request || ! $saved_key || ! $key_request_time ) {
+	if ( ! $saved_key || ! $key_request_time ) {
 		return new WP_Error( 'invalid_request', __( 'Invalid personal data request.' ) );
 	}

diff --git a/wp-includes/version.php b/wp-includes/version.php
index 552c849c3c..a758fdd616 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta3-64996';
+$wp_version = '7.2-beta3-64997';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.