Persistent quadratic block-parser memory exhaustion from an Author post

Summary

WordPress block parsing can repeatedly expand an unbalanced delimiter sequence supplied in an Author-controlled post. The parser retains and reprocesses nested/unbalanced state, causing quadratic CPU/memory cost.

Affected Products

WordPress core 7.0.4; block parser and post-content processing.

Affected Scope

Product

WordPress

Component

Block parser / post-content parsing

Affected function

WP_Block_Parser::parse(); block delimiter tokenization; post_content input

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-400; CWE-1333

Technical Summary

The parser’s handling of many unbalanced block delimiters causes super-linear expansion in parsing work and retained state. The advisory demonstrates the bounded availability effect without publishing a stress payload.

Prerequisites and Permissions

Authenticated user with permission to create or edit a post whose content is parsed by core; the supplied test uses an Author.

Affected Locations

wp-includes/class-wp-block-parser.php; WP_Block_Parser::parse() and token/nesting handling; post_content input. Exact line numbers are not asserted without a pinned source snapshot.

Reproducible Proof

A controlled Author post containing a bounded pathological delimiter pattern reproduced elevated parser resource use under the supplied test environment. The exact pattern is withheld.

Vulnerable Code

if ( $tokenizer->next_token() ) {
	$block = parse_block( $tokenizer );
	$inner_blocks[] = $block;
}

Severity

high

Technical Analysis

Unbalanced block delimiters are accepted by the block parser and trigger repeated token/stack handling while post content is parsed. The resulting work and retained intermediate structures grow super-linearly with crafted input, and the path is reached during normal post save/render operations.

Impact

Availability impact: an authenticated Author can submit content that consumes substantial PHP CPU and memory during parsing, potentially degrading a site serving that content. No privilege escalation, data disclosure, or code execution is claimed.

Remediation

Bound block nesting and total parser work, reject or truncate pathological unbalanced input, and add regression tests measuring time/memory as delimiter count increases.

Timeline

• 2026-09-14Published
• 2026-09-14Advisory published
• 2026-09-14Removed internal finding identifier from the public title and expanded the advisory with source locations and validation evidence.
• 2026-09-14Expanded affected source paths, parameters, negative-control comparison, and observed validation results; withheld the exact payload and turnkey reproduction steps.
• 2026-09-14Published expanded source-path and validation evidence, plus the corrected public title without the internal finding identifier.
• 2026-09-14Return the advisory to private draft status while revising the new structured technical fields.
• 2026-09-15Live

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.