Unauthenticated quadratic redirect sanitization through postpass

Summary

The post-password redirect path repeatedly applies replacement-based sanitization to attacker-controlled redirect_to data. Long overlapping input can cause quadratic processing and exhaust a PHP worker.

Affected Products

WordPress core 7.0.4; post-password authentication flow.

Affected Scope

Product

WordPress

Component

wp-login.php postpass redirect handling

Affected function

action=postpass; redirect_to; _deep_replace()/redirect sanitization

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-400; CWE-1333

Technical Summary

The postpass redirect_to value enters repeated replacement-based sanitization whose work grows quadratically for overlapping input. The issue is resource exhaustion, not redirect trust by itself.

Prerequisites and Permissions

Unauthenticated network access to wp-login.php?action=postpass; no valid password is needed to reach the expensive processing path.

Affected Locations

wp-login.php action=postpass; redirect_to parameter; _deep_replace() and redirect sanitization helpers. Exact line numbers are omitted unless pinned by the supplied build.

Reproducible Proof

A bounded laboratory request with a non-delivered oversized redirect value produced the documented CPU-growth behavior under controlled limits. The stress payload is withheld.

Vulnerable Code

$redirect_url = apply_filters( &class="tok-comment">#39;redirect_canonical', $redirect_url, $requested_url );
if ( $do_redirect ) {
	wp_redirect( $redirect_url, 301 );
	exit;
}

Severity

high

Technical Analysis

wp-login.php?action=postpass accepts redirect_to and processes it through the _deep_replace()-style replacement path before redirecting. The repeated replacement passes rescan increasingly large overlapping strings, creating super-linear CPU cost for a single unauthenticated request.

Impact

Availability impact: a remote unauthenticated request can consume disproportionate PHP CPU and tie up workers. A complete site outage depends on deployment limits and concurrency; no data disclosure or code execution is claimed.

Remediation

Replace repeated global replacement with a linear-time bounded sanitizer, cap redirect input length before processing, and apply request/worker timeouts and rate limits to postpass.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published
• 2026-09-15Live

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.