# Temporary Privilege Changes Require Re-Entrancy Guards A temporary privilege change is safe only when nested execution can't observe it. Process-wide identity is shared mutable state, so code that borrows an administrator context must block re-entry until the original identity is restored. Without that guard, an unprivileged request can enter a protected path during the borrowed-authority window. <!-- atomicity: 1 idea ✓ --> ## Evidence > [!quote] > "The nested serving cycle inherits process-wide globals—including the current user temporarily selected by the Customizer." The WordPress exploit re-entered REST dispatch while the Customizer had temporarily selected a privileged user. A request that failed anonymously was evaluated again with administrator capability. ## Scope & Conditions - **Holds** when identity, tenant, locale, transaction mode, or another security-sensitive context lives in process-wide mutable state. - **Strongest** in event-driven systems where callbacks can trigger nested dispatch before cleanup runs. - **Weaker** when authority is passed explicitly as an immutable value or the runtime enforces request-scoped isolation. ## Links - [[3. Resources/Permanent Notes/Request-Local Caches Are Security Boundaries]] — the data-side sibling in the same chain: cache state carries poisoned objects while global identity carries borrowed authority - [[3. Resources/Permanent Notes/Sanitize by Value Not by Input Type]] — contrast between the chain's input-validation failure and its later runtime-authorization failure - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — the nested-dispatch transition is the hard-to-explain step that made the agent-found chain operational - [[WordPress Hosting Security Stack MOC]] — home for the WordPress core-security mechanics this rule generalizes ## Source - [[3. Resources/Readwise/Articles/How Two WordPress Core Bugs Chained into Pre-Auth RCE]] — BugBunny.ai, 2026; highlight on nested REST dispatch inheriting the borrowed administrator identity.