[wp-trac] [WordPress Trac] #64560: Speculative Loading API can expose server path when using a theme directory outside the document root

WordPress Trac noreply at wordpress.org
Thu Jan 29 22:07:42 UTC 2026


#64560: Speculative Loading API can expose server path when using a theme directory
outside the document root
--------------------------+------------------------------
 Reporter:  emrl          |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  General       |     Version:  6.8
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:  performance
--------------------------+------------------------------

Comment (by emrl):

 @westonruter Right, I'm not sure really. The Speculative API is where I
 happened to notice it, but it was just unexpected behavior for
 `get_stylesheet_directory_uri()` to ever return an absolute server path.

 I know the issue goes away when a typical theme location is used, but I
 figured I would open the bug to raise awareness that it ''could'' happen.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/64560#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform


More information about the wp-trac mailing list