Use wp_safe_remote_get for Starter Kit URL import (#2732)

pfefferle · web-flow · commit b681d6436e0f · 2026-01-08T12:50:53.000+01:00
diff --git a/.github/changelog/fix-starter-kit-safe-remote-get b/.github/changelog/fix-starter-kit-safe-remote-get
@@ -0,0 +1,4 @@
+Significance: patch
+Type: security
+
+Improved security of the Starter Kit URL import by using wp_safe_remote_get.
diff --git a/includes/wp-admin/import/class-starter-kit.php b/includes/wp-admin/import/class-starter-kit.php
@@ -197,7 +197,7 @@ public static function handle_url_import() {
 		}
 
 		// Fetch the URL content.
-		$response = \wp_remote_get(
+		$response = \wp_safe_remote_get(
 			$url,
 			array(
 				'timeout'     => 30,

Original file line number	Diff line number	Diff line change
`@@ -197,7 +197,7 @@ public static function handle_url_import() {`
`197`	`197`	`}`
`198`	`198`
`199`	`199`	`// Fetch the URL content.`
`200`		`- $response = \wp_remote_get(`
	`200`	`+ $response = \wp_safe_remote_get(`
`201`	`201`	`$url,`
`202`	`202`	`array(`
`203`	`203`	`'timeout' => 30,`