CVE-2026-66450: Php Extract Overwrite To Dynamic Includecve-2026-66450-php-extract-overwrite-to-dynamic-include
extract() with EXTR_OVERWRITE (or no flag, which defaults to EXTR_OVERWRITE) imports every key of the given array as a local variable and overwrites variables already defined in the enclosing scope, including function parameters. When the array's KEY SET is request-controlled (e.g. a wp_parse_args()-built array like $this->query_vars), an attacker can supply
