From 86f59f883c3093970a2f2962874fcf56a3d536e6 Mon Sep 17 00:00:00 2001
From: YvesCesar <yvesamorim73@gmail.com>
Date: Wed, 7 Oct 2026 09:37:23 -0400
Subject: [PATCH 1/2] fix: deny PHP execution inside vendor folders under
 wp-content

Signed-off-by: YvesCesar <yvesamorim73@gmail.com>
---
 .docker/nginx/conf.d/default.conf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.docker/nginx/conf.d/default.conf b/.docker/nginx/conf.d/default.conf
index c225ccc..e5cff82 100644
--- a/.docker/nginx/conf.d/default.conf
+++ b/.docker/nginx/conf.d/default.conf
@@ -25,6 +25,9 @@ server {
     location ~* ^/wp-content/uploads/.*\.php$ {
         deny all;
     }
+    location ~* ^/wp-content/.*/vendor(-bin)?/.*\.php$ {
+        deny all;
+    }
     location ~ \.php$ {
         try_files $uri =404;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;

From 3e415a28a6fd15e87969661ec8bfee73349fb3ef Mon Sep 17 00:00:00 2001
From: YvesCesar <yvesamorim73@gmail.com>
Date: Wed, 7 Oct 2026 09:37:23 -0400
Subject: [PATCH 2/2] test: cover PHP execution under vendor folders

Signed-off-by: YvesCesar <yvesamorim73@gmail.com>
---
 tests/security/helpers/nginx.bash |  9 +++++
 tests/security/vendor-php.bats    | 66 +++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 tests/security/vendor-php.bats

diff --git a/tests/security/helpers/nginx.bash b/tests/security/helpers/nginx.bash
index 845e434..4dbebaf 100644
--- a/tests/security/helpers/nginx.bash
+++ b/tests/security/helpers/nginx.bash
@@ -85,6 +85,15 @@ nginx_hardening_integration_setup() {
 		php:8.3-fpm)"
 }
 
+nginx_hardening_document_root_file() {
+	local path="$1"
+	local content="$2"
+	local file="${nginx_hardening_tmp}/document-root/${path}"
+
+	mkdir -p "$(dirname "${file}")"
+	printf '%s\n' "${content}" > "${file}"
+}
+
 nginx_hardening_integration_start() {
 	local value="${1-__UNSET__}"
 	local -a environment_args=()
diff --git a/tests/security/vendor-php.bats b/tests/security/vendor-php.bats
new file mode 100644
index 0000000..64a4b54
--- /dev/null
+++ b/tests/security/vendor-php.bats
@@ -0,0 +1,66 @@
+#!/usr/bin/env bats
+
+load 'helpers/nginx.bash'
+
+setup() {
+	nginx_hardening_integration_setup
+	nginx_hardening_document_root_file wp-content/themes/theme/vendor/wordpress/wp-admin/setup-config.php '<?php echo "PHP_UPSTREAM_REACHED";'
+	nginx_hardening_document_root_file wp-content/plugins/plugin/vendor/autoload.php '<?php echo "PHP_UPSTREAM_REACHED";'
+	nginx_hardening_document_root_file wp-content/plugins/plugin/vendor-bin/tool/run.php '<?php echo "PHP_UPSTREAM_REACHED";'
+	nginx_hardening_document_root_file wp-content/plugins/plugin/vendor/package/style.css 'body {}'
+	nginx_hardening_document_root_file wp-content/plugins/plugin/plugin.php '<?php echo "PHP_UPSTREAM_REACHED";'
+	nginx_hardening_integration_start
+	nginx_hardening_config_is_valid
+}
+
+teardown() {
+	nginx_hardening_integration_stop
+}
+
+@test "real nginx config blocks PHP under a theme vendor folder" {
+	run nginx_hardening_request GET /wp-content/themes/theme/vendor/wordpress/wp-admin/setup-config.php
+	[ "${status}" -eq 0 ]
+	nginx_hardening_assert_status 403 "${output}"
+	nginx_hardening_assert_upstream_not_reached
+}
+
+@test "real nginx config blocks PHP under a plugin vendor folder" {
+	run nginx_hardening_request GET /wp-content/plugins/plugin/vendor/autoload.php
+	[ "${status}" -eq 0 ]
+	nginx_hardening_assert_status 403 "${output}"
+	nginx_hardening_assert_upstream_not_reached
+}
+
+@test "real nginx config blocks PHP under a plugin vendor-bin folder" {
+	run nginx_hardening_request GET /wp-content/plugins/plugin/vendor-bin/tool/run.php
+	[ "${status}" -eq 0 ]
+	nginx_hardening_assert_status 403 "${output}"
+	nginx_hardening_assert_upstream_not_reached
+}
+
+@test "real nginx config blocks PHP under a vendor folder regardless of case" {
+	run nginx_hardening_request GET /wp-content/plugins/plugin/VENDOR/autoload.php
+	[ "${status}" -eq 0 ]
+	nginx_hardening_assert_status 403 "${output}"
+	nginx_hardening_assert_upstream_not_reached
+}
+
+@test "real nginx config blocks PHP under a vendor folder reached through an encoded path" {
+	run nginx_hardening_request GET /wp-content/plugins/plugin/%76endor/autoload.php
+	[ "${status}" -eq 0 ]
+	nginx_hardening_assert_status 403 "${output}"
+	nginx_hardening_assert_upstream_not_reached
+}
+
+@test "real nginx config serves static files under a vendor folder" {
+	run nginx_hardening_request GET /wp-content/plugins/plugin/vendor/package/style.css
+	[ "${status}" -eq 0 ]
+	nginx_hardening_assert_status 200 "${output}"
+}
+
+@test "real nginx config still runs plugin PHP outside vendor folders" {
+	run nginx_hardening_request GET /wp-content/plugins/plugin/plugin.php
+	[ "${status}" -eq 0 ]
+	nginx_hardening_assert_status 200 "${output}"
+	nginx_hardening_assert_upstream_reached
+}