u/HongPong

Something is up at UPenn , a lot of stoplights are dead on market Street and Chestnut is closed off. traffic tangled recommend staying away for the moment.

Pretty recently I was concerned that there are too many loose WP-JSON endpoints active by default in Wordpress. We see now that /wp-json/batch/v1 caught a 9.8 severity CVE which, combined with a SQL injection flaw, is giving everyone Friday/ weekend headaches. Batch was introduced back in 5.6 but at this point it is not easy to audit, for example, if you really need to keep this endpoint open on the internet for your site. Unauthenticated wp-json access is the design default.

There is a deprecated filter if REST API is enabled: https://developer.wordpress.org/reference/hooks/rest_enabled/

This is the way to check for authentication errors; https://developer.wordpress.org/reference/hooks/rest_authentication_errors/

This was recommended as a way to get REST API access under control - https://github.com/10up/10up-experience It does a grab bag of stuff but can impose authentication, shut off the infamous users endpoint that gives out so much info by default, etc.

I strongly think that the plugins directory should present a scanned result of whether the WP-JSON is used by the plugin including whether it is authenticated or unauthenticated, and any given path it might use. Then the rest of the paths can safely be closed off, or we can select better engineered plugins.

It is not easy to tell if you really need WP-JSON allowed for anonymous visitors. While of course there are major plugins like redirection that use it to populate their admin panels, in replacement of the old admin-ajax approach. I really wish wp-json administrative /editor endpoint was simply split from any public endpoint. Gutenberg is dependent on it (Authenticated apparently). Jetpack as well.

You can shut off unauthenticated rest in this fashion:

add_filter('rest_authentication_errors', function ($result) {

if (!empty($result)) {

return $result;

}

if (!is_user_logged_in()) {

return new WP_Error(

'rest_not_logged_in',

'REST API restricted to authenticated users.',

array('status' => 401)

);

}

return $result;

});

But this could break form plugins or etc.

This can block the user endpoint nonsense:

add_filter('rest_endpoints', function ($endpoints) {

if (isset($endpoints['/wp/v2/users'])) {

unset($endpoints['/wp/v2/users']);

}

if (isset($endpoints['/wp/v2/users/(?P<id>[\d]+)'])) {

unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);

}

return $endpoints;

});

Anyway it is pretty evident to me that something like the 10up-experience stuff should be added as defaults in WP core.

In other related problems, WordPress should use ORM to manage all database queries instead of sprinkling them around the code base to prevent the SQL injection such as the vuln type that contributed to yesterday's security patches. And WordPress 7 should require PHP8.2 which is still in security support until 2027, since all prior versions are out of coverage. (They could do something like add a scanner with rector to flag flawed plugins internally as part of Site Health.)

Endpoints should correctly be assessed as an attack surface, not a huge block of default enabled features. And it should not be so difficult to audit them, by needing to jam in a logger and run it a while to even figure out what is being hit. Thanks for the consideration, now's the time to think about it all IMO. Thanks to my friend who sussed out a lot of this for me!! (it wasn't my digging originally).

please be advised the toxic wildfire plume has hit Philly since 8pm or so and it's expected to be harmful thru Friday at least. the city are distributing this URL which is not very detailed https://airqualitypartnership.org/

the screenshot above is from purpleair.com real time sensors in the last 10 minutes. you definitely want N95 masks, indoor air filters etc for the next couple days if you can.

the plume is obviously on a lower altitude than the higher stuff that was around last day or 2.

Reformers claim eight wards turned over by new leadership citywide; City’s Democratic Party Contest Committee to hear Ward 22 challenge Sunday

On the evening of Monday, June 8, across the city, Democratic Party ward organization meetings convened to select ward leaders from among committee people, who were just elected in a May 19 primary. The “open wards” movement flipped several wards around the city, but in a controversial meeting, Ward 22 leadership refused to allow a person-by-person vote.

In the heated meeting, Cindy Bass, the previous term’s ward leader and city council member, quickly held a voice vote, declared herself once again the chair, and closed the meeting within a few minutes, a recording obtained by Unicorn Riot showed. People spilled out of the Germantown Seventh-Day Adventist Church on Cliveden Street as our reporter arrived at about 8:05 p.m., many frustrated that they had been denied any attempt to get their votes individually counted.

Full story and 17 minute video on Unicorn Riot.

https://unicornriot.ninja/2026/the-man-running-the-mypillow-ceos-bid-for-mn-governor/

Campaign pamphlets were stacked neatly on each chair, with one bizarre addition: MyPillow CEO Mike Lindell’s 2019 memoir What are the Odds? From Crack Addict to CEO. A sticker on the bottom left corner of each copy’s holographic cover explained they were “paid for by Mike Lindell for Governor.”

Recent events portray the neo-fascist organization that shattered under pressure following January 6, 2021, as a group beyond the control of its leader.

Full story: https://unicornriot.ninja/2026/the-delaney-hall-proud-boys/

Activists with the Sunrise Movement Philly chapter are on a hunger strike to further their demands for allocating some of the city budget surplus to local services. An interview at City Hall. More coverage to come. Interview recorded 5/25/2026