# Request-Local Caches Are Security Boundaries A request-local cache becomes a security boundary when later code treats cached objects as authoritative state. If attacker-controlled query output can populate that cache, a read primitive can become a write primitive without crossing the database boundary first. Security review must trace who can seed cached objects before trusting code that merges them into durable state. <!-- atomicity: 1 idea ✓ --> ## Evidence > [!quote] > "That creates an in-memory WP_Post cache-poisoning primitive." The WordPress 7.0.2 exploit used SQL injection to fabricate `WP_Post` objects in the request cache. A later sparse update trusted those cached fields, which carried attacker-shaped data into a real database write. ## Scope & Conditions - **Holds** when a request cache stores rich domain objects that later write paths reuse without reloading authoritative state. - **Strongest** when one request can both poison the cache and trigger a sparse merge into durable storage. - **Weaker** when cache entries are immutable primitives or every privileged write reloads and validates the authoritative record. ## Links - [[3. Resources/Permanent Notes/Temporary Privilege Changes Require Re-Entrancy Guards]] — the neighboring shared-state boundary in the same exploit chain: cached objects carry data while process-wide identity carries authority - [[3. Resources/Permanent Notes/Sanitize by Value Not by Input Type]] — the sink-level validation failure creates the attacker-controlled query output that seeds the poisoned cache - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — this cache-to-write bridge is part of the post-exploitation chain whose discovery was faster than its human explanation - [[WordPress Hosting Security Stack MOC]] — home for the core-security mechanics and the hosting defenses that contain their blast radius ## Source - [[3. Resources/Readwise/Articles/How Two WordPress Core Bugs Chained into Pre-Auth RCE]] — BugBunny.ai, 2026; highlights on cache poisoning and the sparse `wp_update_post()` merge.