Package: wordpress
Version: 6.9.4+dfsg1-1
Severity: important
Dear Maintainer,
wordpress 6.9.4+dfsg1-1:
In Wordpress with multisite enabled, with superadmin on any site, add a new
user with skip confirmation email and it will error:
“Skip Confirmation Email” fatals in wp-admin/user-new.php.
The code in question only gets triggered in teh skip confirmation email pathway.
[15-Jun-2026 23:36:08 UTC] PHP Fatal error: Uncaught Error: Cannot use object
of type stdClass as array in /usr/share/wordpress/wp-admin/user-new.php:244
Stack trace: #0 {main} thrown in /usr/share/wordpress/wp-admin/user-new.php on
line 244
In that area of code:
$wpdb->get_row() returns stdClass by default, but Debian-patched
user-new.php line 244 accesses the result as an array:
$row['activation_key']
$row['signup_id']
Fatal:
Cannot use object of type stdClass as array
This appears to be a regression introduced by Debian's downstream
`38474.patch`, rather than by WordPress 6.9 itself.
The same faulty hunk is present in Debian's WordPress 6.8.3 package, and the
patch metadata lists `Last-Update: 2023-08-10`. It may have affected Debian
WordPress packages since the 6.3-era update in August 2023 although I have not
confirmed this.
The issue is also present in the newly uploaded Debian unstable package
wordpress 7.0+dfsg1-1. Its debian/patches/38474.patch still changes
wp-admin/user-new.php in the same way.
Changing these to:
$row->activation_key
$row->signup_id
fixes the error.
-- System Information:
Debian Release: 13.4
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable'), (100, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-41-amd64 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8),
LANGUAGE=en_AU:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages wordpress depends on:
ii apache2 [httpd] 2.4.67-1
ii ca-certificates 20250419
ii libapache2-mod-php 2:8.4+96
ii libapache2-mod-php8.4 [libapache2-mod-php] 8.4.16-1~deb13u1
ii libjs-cropper 1.2.2-2
ii libjs-lodash 4.18.1+dfsg-3
ii libjs-underscore 1.13.8~dfsg+~1.13.0-1
ii mariadb-client [virtual-mysql-client] 1:11.8.6-0+deb13u1
ii php-gd 2:8.4+96
ii php-getid3 1.9.25+dfsg-1
ii php-mysql 2:8.4+96
ii php8.4-gd [php-gd] 8.4.16-1~deb13u1
ii php8.4-mysql [php-mysqlnd] 8.4.16-1~deb13u1
Versions of packages wordpress recommends:
ii wordpress-l10n 6.9.4+dfsg1-1
ii wordpress-theme-twentytwentyfive 6.9.4+dfsg1-1
Versions of packages wordpress suggests:
ii mariadb-server [virtual-mysql-server] 1:11.8.6-0+deb13u1
pn php-curl <none>
pn php-imagick <none>
pn php-mbstring <none>
pn php-ssh2 <none>
pn php-zip <none>
ii php8.4-xml [php-xml] 8.4.16-1~deb13u1
-- Configuration Files:
/etc/wordpress/htaccess changed [not included]
-- no debconf information
