From 4bbdf78c53b39c8f2e3d8150b93e38aaf8dae6fb Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@xwp.co>
Date: Sat, 28 Feb 2026 00:42:43 +0000
Subject: [PATCH] REST API: Guard against passing `null` as `$prepared_args` to
 `WP_REST_Posts_Controller::prepare_items_query()`.

The variable may get set to `null` by a filter or subclass.

Developed in https://github.com/WordPress/wordpress-develop/pull/7625

Follow-up to r38832.

Props apermo, dmsnell, westonruter.
Fixes #62287.

Built from https://develop.svn.wordpress.org/trunk@61773


git-svn-id: http://core.svn.wordpress.org/trunk@61079 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 .../rest-api/endpoints/class-wp-rest-posts-controller.php | 8 +++++++-
 .../endpoints/class-wp-rest-revisions-controller.php      | 8 +++++++-
 wp-includes/version.php                                   | 2 +-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
index fa8eb1251e..8e343d2447 100644
--- a/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
+++ b/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
@@ -441,7 +441,10 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 		 * @param array           $args    Array of arguments for WP_Query.
 		 * @param WP_REST_Request $request The REST API request.
 		 */
-		$args       = apply_filters( "rest_{$this->post_type}_query", $args, $request );
+		$args = apply_filters( "rest_{$this->post_type}_query", $args, $request );
+		if ( ! is_array( $args ) ) {
+			$args = array();
+		}
 		$query_args = $this->prepare_items_query( $args, $request );
 
 		$posts_query  = new WP_Query();
@@ -1211,6 +1214,9 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 	 */
 	protected function prepare_items_query( $prepared_args = array(), $request = null ) {
 		$query_args = array();
+		if ( ! is_array( $prepared_args ) ) {
+			$prepared_args = array();
+		}
 
 		foreach ( $prepared_args as $key => $value ) {
 			/**
diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php
index b218cc3ec1..99282e6d3e 100644
--- a/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php
+++ b/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php
@@ -298,7 +298,10 @@ class WP_REST_Revisions_Controller extends WP_REST_Controller {
 			}
 
 			/** This filter is documented in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php */
-			$args       = apply_filters( 'rest_revision_query', $args, $request );
+			$args = apply_filters( 'rest_revision_query', $args, $request );
+			if ( ! is_array( $args ) ) {
+				$args = array();
+			}
 			$query_args = $this->prepare_items_query( $args, $request );
 
 			$revisions_query = new WP_Query();
@@ -549,6 +552,9 @@ class WP_REST_Revisions_Controller extends WP_REST_Controller {
 	 */
 	protected function prepare_items_query( $prepared_args = array(), $request = null ) {
 		$query_args = array();
+		if ( ! is_array( $prepared_args ) ) {
+			$prepared_args = array();
+		}
 
 		foreach ( $prepared_args as $key => $value ) {
 			/** This filter is documented in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php */
diff --git a/wp-includes/version.php b/wp-includes/version.php
index aad719a746..fa4eb99c80 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.0-beta2-61772';
+$wp_version = '7.0-beta2-61773';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.