Quadratic comment-author URL cookie processing on every request

Summary

The comment_author_url cookie is processed on ordinary requests through repeated replacement logic. A long overlapping value can induce quadratic CPU work without authentication.

Affected Products

WordPress core 7.0.4; comment cookie handling.

Affected Scope

Product

WordPress

Component

Comment cookie parsing

Affected function

comment_author_url cookie; _deep_replace()/sanitize_comment_cookies()

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-400; CWE-1333

Technical Summary

An attacker-controlled comment_author_url cookie reaches repeated replacement processing on normal requests, creating a quadratic-cost input path.

Prerequisites and Permissions

Unauthenticated HTTP access to any route that initializes comment cookies; no valid account is required.

Affected Locations

wp-includes/comment.php cookie parsing; comment_author_url; _deep_replace() replacement loop.

Reproducible Proof

A bounded laboratory cookie value reproduced the documented CPU-growth behavior under controlled request limits. The stress value and automation are withheld.

Vulnerable Code

$commentPostId = isset( $_POST[&class="tok-comment">#39;comment_post_IDclass="tok-string">'] ) ? (int) $_POST['comment_post_ID'] : 0;
$commentParent = isset( $_POST[&class="tok-comment">#39;comment_parentclass="tok-string">'] ) ? max( 0, (int) $_POST['comment_parent'] ) : 0;
$commentdata = array(
	&class="tok-comment">#39;comment_post_ID' => $commentPostId,
	&class="tok-comment">#39;comment_parent' => $commentParent,
	&class="tok-comment">#39;comment_author_urlclass="tok-string">' => (string) ( $_POST['urlclass="tok-string">'] ?? '' ),
	&class="tok-comment">#39;comment_contentclass="tok-string">' => (string) ( $_POST['commentclass="tok-string">'] ?? '' ),
);

Severity

medium

Technical Analysis

WordPress reads the comment_author_url cookie and passes it through the _deep_replace()-style sanitization path on each request. Repeated overlapping replacements rescan the value and can grow super-linearly with input length.

Impact

Availability impact: an unauthenticated client can consume excess PHP CPU per request. Site-wide outage depends on worker limits and request concurrency; no confidentiality or integrity impact is claimed.

Remediation

Bound cookie length before sanitization, replace repeated rescanning with a linear-time canonicalizer, and rate-limit or reject pathological cookie values early.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.