[wp-trac] [WordPress Trac] #51094: WP_Query.query with invalid post_status will return all

[WordPress Trac]

#51094: WP_Query.query with invalid post_status will return all
--------------------------+------------------------------
 Reporter:  carsonreinke  |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Query         |     Version:  trunk
 Severity:  critical      |  Resolution:
 Keywords:                |     Focuses:
--------------------------+------------------------------
Changes (by xParham):

 * severity:  minor => critical


Comment:

 I also believe this is a bug in `WP_Query` and actually one with
 potentially serious consequences. I came across the bug running a `wp
 post` CLI command, in my case passing an unregistered custom post status.

 But here is another case, if you simply have a typo in your command,
 passing `pendin` instead of `pending` here:
 `wp post delete $(wp post list --post_type='post' --post_status=pendin
 --format=ids) --force`

 You will end up having ALL of your posts deleted.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/51094#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform