Commit 85a7dafada for wordpress.org

commit 85a7dafada7d32f436913f50b932b697aa3a1591
Author: adamsilverstein <adamsilverstein@git.wordpress.org>
Date:   Thu Sep 17 17:31:42 2026 +0000

    XML-RPC: Reject writes to internal-only builtin post types.

    Props xknown, westonruter, jorbin, johnbillion.


    Built from https://develop.svn.wordpress.org/trunk@63660


    git-svn-id: http://core.svn.wordpress.org/trunk@62834 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index dcb2636d7a..1a0a462622 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -1481,6 +1481,33 @@ class wp_xmlrpc_server extends IXR_Server {
 			return new IXR_Error( 403, __( 'Invalid post type.' ) );
 		}

+		// Reject writes to internal-only builtin post types (e.g. customize_changeset)
+		// whose intended write path is a dedicated helper, not a generic post API.
+		$is_internal_only = (
+			empty( $post_type->public )
+			&& empty( $post_type->show_in_rest )
+			&& ! empty( $post_type->_builtin )
+		);
+
+		/**
+		 * Filters whether a post type accepts writes via XML-RPC.
+		 *
+		 * Defaults to false for internal-only builtin post types (public=false,
+		 * show_in_rest=false, _builtin=true), such as customize_changeset, whose
+		 * writes are meant to flow through dedicated helpers. Return true to opt
+		 * a post type back in.
+		 *
+		 * @since 7.1.1
+		 *
+		 * @param bool         $allowed   Whether the post type accepts XML-RPC writes.
+		 * @param WP_Post_Type $post_type The post type object.
+		 */
+		$allowed = apply_filters( 'xmlrpc_allow_post_type_writes', ! $is_internal_only, $post_type );
+
+		if ( ! $allowed ) {
+			return new IXR_Error( 403, __( 'Sorry, this post type is not supported over XML-RPC.' ) );
+		}
+
 		$update = ! empty( $post_data['ID'] );

 		if ( $update ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index f5b3b1998f..2e9783e246 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63659';
+$wp_version = '7.2-alpha-63660';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.