For those reviewing the changeset: There are two places where they read a value directly from $POST into an $args array. There is no validation applied, which means an attacker can inject whatever value they wish.
- It’s a specific symptom fix: The same problem could occur with $_COOKIE or $_REQUEST always being available
- The cleanup is not done in a finally{}, so random missing vars when an exception occurs.
Exec summary: Horrible code as always in WP.
> want free plugins to add functionality to site
> absolutely will not hire developers or pay for software or plugins
> how dare the free plugin for my free software not be coded to the highest standards