WordPress · aristath · Oct 11, 2023 · Oct 11, 2023 · Oct 11, 2023 · Oct 11, 2023
diff --git a/src/index.php b/src/index.php
@@ -11,16 +11,20 @@
 	define( 'ABSPATH', __DIR__ . '/' );
 }
 
+if ( ! defined( 'WPINC' ) ) {
+	define( 'WPINC', 'wp-includes' );
+}
+
+require_once ABSPATH . WPINC . '/class-wp-autoload.php';
+
 /*
  * Load the actual index.php file if the assets were already built.
- * Note: WPINC is not defined yet, it is defined later in wp-settings.php.
  */
-if ( file_exists( ABSPATH . 'wp-includes/js/jquery/jquery.js' ) && is_dir( ABSPATH . 'wp-includes/build' ) ) {
+if ( file_exists( ABSPATH . WPINC . '/js/jquery/jquery.js' ) && is_dir( ABSPATH . WPINC . '/build' ) ) {
 	require_once ABSPATH . '_index.php';
 	return;
 }
 
-define( 'WPINC', 'wp-includes' );
 require_once ABSPATH . WPINC . '/version.php';
 require_once ABSPATH . WPINC . '/compat.php';
 require_once ABSPATH . WPINC . '/load.php';

diff --git a/src/wp-admin/custom-background.php b/src/wp-admin/custom-background.php
@@ -15,6 +15,3 @@
 }
 
 _deprecated_file( basename( __FILE__ ), '5.3.0', 'wp-admin/includes/class-custom-background.php' );
-
-/** Custom_Background class */
-require_once ABSPATH . 'wp-admin/includes/class-custom-background.php';
diff --git a/src/wp-admin/custom-header.php b/src/wp-admin/custom-header.php
@@ -15,6 +15,3 @@
 }
 
 _deprecated_file( basename( __FILE__ ), '5.3.0', 'wp-admin/includes/class-custom-image-header.php' );
-
-/** Custom_Image_Header class */
-require_once ABSPATH . 'wp-admin/includes/class-custom-image-header.php';
diff --git a/src/wp-admin/includes/admin.php b/src/wp-admin/includes/admin.php
@@ -42,9 +42,6 @@
 /** WordPress Misc Administration API */
 require_once ABSPATH . 'wp-admin/includes/misc.php';
 
-/** WordPress Misc Administration API */
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-policy-content.php';
-
 /** WordPress Options Administration API */
 require_once ABSPATH . 'wp-admin/includes/options.php';
 
@@ -55,7 +52,6 @@
 require_once ABSPATH . 'wp-admin/includes/post.php';
 
 /** WordPress Administration Screen API */
-require_once ABSPATH . 'wp-admin/includes/class-wp-screen.php';
 require_once ABSPATH . 'wp-admin/includes/screen.php';
 
 /** WordPress Taxonomy Administration API */
@@ -65,8 +61,6 @@
 require_once ABSPATH . 'wp-admin/includes/template.php';
 
 /** WordPress List Table Administration API and base class */
-require_once ABSPATH . 'wp-admin/includes/class-wp-list-table.php';
-require_once ABSPATH . 'wp-admin/includes/class-wp-list-table-compat.php';
 require_once ABSPATH . 'wp-admin/includes/list-table.php';
 
 /** WordPress Theme Administration API */
@@ -75,18 +69,9 @@
 /** WordPress Privacy Functions */
 require_once ABSPATH . 'wp-admin/includes/privacy-tools.php';
 
-/** WordPress Privacy List Table classes. */
-// Previously in wp-admin/includes/user.php. Need to be loaded for backward compatibility.
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-requests-table.php';
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php';
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php';
-
 /** WordPress User Administration API */
 require_once ABSPATH . 'wp-admin/includes/user.php';
 
-/** WordPress Site Icon API */
-require_once ABSPATH . 'wp-admin/includes/class-wp-site-icon.php';
-
 /** WordPress Update Administration API */
 require_once ABSPATH . 'wp-admin/includes/update.php';
 

diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php
@@ -366,8 +366,6 @@ function wp_ajax_autocomplete_user() {
  * @since 4.8.0
  */
 function wp_ajax_get_community_events() {
-	require_once ABSPATH . 'wp-admin/includes/class-wp-community-events.php';
-
 	check_ajax_referer( 'community_events' );
 
 	$search         = isset( $_POST['location'] ) ? wp_unslash( $_POST['location'] ) : '';
@@ -1944,10 +1942,6 @@ function wp_ajax_wp_link_ajax() {
 
 	$args['pagenum'] = ! empty( $_POST['page'] ) ? absint( $_POST['page'] ) : 1;
 
-	if ( ! class_exists( '_WP_Editors', false ) ) {
-		require ABSPATH . WPINC . '/class-wp-editor.php';
-	}
-
 	$results = _WP_Editors::wp_link_query( $args );
 
 	if ( ! isset( $results ) ) {
@@ -4035,7 +4029,6 @@ function wp_ajax_crop_image() {
 
 	switch ( $context ) {
 		case 'site-icon':
-			require_once ABSPATH . 'wp-admin/includes/class-wp-site-icon.php';
 			$wp_site_icon = new WP_Site_Icon();
 
 			// Skip creating a new attachment if the attachment is a Site Icon.
@@ -4186,7 +4179,6 @@ function wp_ajax_install_theme() {
 		wp_send_json_error( $status );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
 	require_once ABSPATH . 'wp-admin/includes/theme.php';
 
 	$api = themes_api(
@@ -4318,8 +4310,6 @@ function wp_ajax_update_theme() {
 		$status['oldVersion'] = $theme->get( 'Version' );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
-
 	$current = get_site_transient( 'update_themes' );
 	if ( empty( $current ) ) {
 		wp_update_themes();
@@ -4479,7 +4469,6 @@ function wp_ajax_install_plugin() {
 		wp_send_json_error( $status );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
 	require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
 
 	$api = plugins_api(
@@ -4651,8 +4640,6 @@ function wp_ajax_update_plugin() {
 		$status['oldVersion'] = sprintf( __( 'Version %s' ), $plugin_data['Version'] );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
-
 	wp_update_plugins();
 
 	$skin     = new WP_Ajax_Upgrader_Skin();
@@ -5380,10 +5367,6 @@ function wp_ajax_health_check_dotorg_communication() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Site_Health' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php';
-	}
-
 	$site_health = WP_Site_Health::get_instance();
 	wp_send_json_success( $site_health->get_test_dotorg_communication() );
 }
@@ -5413,10 +5396,6 @@ function wp_ajax_health_check_background_updates() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Site_Health' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php';
-	}
-
 	$site_health = WP_Site_Health::get_instance();
 	wp_send_json_success( $site_health->get_test_background_updates() );
 }
@@ -5446,10 +5425,6 @@ function wp_ajax_health_check_loopback_requests() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Site_Health' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php';
-	}
-
 	$site_health = WP_Site_Health::get_instance();
 	wp_send_json_success( $site_health->get_test_loopback_requests() );
 }
@@ -5496,10 +5471,6 @@ function wp_ajax_health_check_get_sizes() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Debug_Data' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-debug-data.php';
-	}
-
 	$sizes_data = WP_Debug_Data::get_sizes();
 	$all_sizes  = array( 'raw' => 0 );
 

diff --git a/src/wp-admin/includes/class-ftp.php b/src/wp-admin/includes/class-ftp.php
@@ -913,8 +913,6 @@ function PopError(){
 	$mod_sockets = extension_loaded( 'sockets' );
 }
 
-require_once __DIR__ . "/class-ftp-" . ( $mod_sockets ? "sockets" : "pure" ) . ".php";
-
 if ( $mod_sockets ) {
 	class ftp extends ftp_sockets {}
 } else {

diff --git a/src/wp-admin/includes/class-wp-filesystem-ftpsockets.php b/src/wp-admin/includes/class-wp-filesystem-ftpsockets.php
@@ -32,11 +32,6 @@ public function __construct( $opt = '' ) {
 		$this->method = 'ftpsockets';
 		$this->errors = new WP_Error();
 
-		// Check if possible to use ftp functions.
-		if ( ! require_once ABSPATH . 'wp-admin/includes/class-ftp.php' ) {
-			return;
-		}
-
 		$this->ftp = new ftp();
 
 		if ( empty( $opt['port'] ) ) {

diff --git a/src/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php b/src/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php
@@ -7,10 +7,6 @@
  * @since 4.9.6
  */
 
-if ( ! class_exists( 'WP_Privacy_Requests_Table' ) ) {
-	require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-requests-table.php';
-}
-
 /**
  * WP_Privacy_Data_Export_Requests_Table class.
  *

diff --git a/src/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php b/src/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php
@@ -7,10 +7,6 @@
  * @since 4.9.6
  */
 
-if ( ! class_exists( 'WP_Privacy_Requests_Table' ) ) {
-	require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-requests-table.php';
-}
-
 /**
  * WP_Privacy_Data_Removal_Requests_List_Table class.
  *

diff --git a/src/wp-admin/includes/class-wp-site-health-auto-updates.php b/src/wp-admin/includes/class-wp-site-health-auto-updates.php
@@ -9,15 +9,6 @@
 
 #[AllowDynamicProperties]
 class WP_Site_Health_Auto_Updates {
-	/**
-	 * WP_Site_Health_Auto_Updates constructor.
-	 *
-	 * @since 5.2.0
-	 */
-	public function __construct() {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
-	}
-
 
 	/**
 	 * Runs tests to determine if auto-updates can run.
@@ -144,10 +135,6 @@ public function test_filters_automatic_updater_disabled() {
 	 * @return array|false The test results if auto-updates are disabled, false otherwise.
 	 */
 	public function test_wp_automatic_updates_disabled() {
-		if ( ! class_exists( 'WP_Automatic_Updater' ) ) {
-			require_once ABSPATH . 'wp-admin/includes/class-wp-automatic-updater.php';
-		}
-
 		$auto_updates = new WP_Automatic_Updater();
 
 		if ( ! $auto_updates->is_disabled() ) {

diff --git a/src/wp-admin/includes/class-wp-site-health.php b/src/wp-admin/includes/class-wp-site-health.php
@@ -1753,10 +1753,6 @@ public function get_test_background_updates() {
 			'test'        => 'background_updates',
 		);
 
-		if ( ! class_exists( 'WP_Site_Health_Auto_Updates' ) ) {
-			require_once ABSPATH . 'wp-admin/includes/class-wp-site-health-auto-updates.php';
-		}
-
 		/*
 		 * Run the auto-update tests in a separate class,
 		 * as there are many considerations to be made.
@@ -2386,6 +2382,94 @@ public function get_test_file_uploads() {
 		return $result;
 	}
 
+	/**
+	 * Tests if any of the WordPress Core classes are overridden.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @return array
+	 */
+	public static function get_test_core_classes_paths() {
+		$overridden_classes = array();
+		/*
+		 * Bypass check for WP_Object_Cache.
+		 *
+		 * It is intended that persistent caching plugins replace the core version
+		 * of WP_Object_Cache with their own version so it shouldn't be reported
+		 * as an error in site health.
+		 */
+		$wp_core_classes = WP_Autoload::CLASSES_PATHS;
+		unset( $wp_core_classes['wp_object_cache'] );
+		foreach ( $wp_core_classes as $class_name => $class_path ) {
+			$default_path = wp_normalize_path( ABSPATH . $class_path );
+
+			/*
+			 * Skip classes that cannot be loaded. A class that is missing or
+			 * otherwise not loadable should not be reported as overridden, and
+			 * must not be allowed to fatal this test.
+			 */
+			if ( ! class_exists( $class_name ) ) {
+				continue;
+			}
+
+			/*
+			 * Init a Reflection class to get the real path of the class.
+			 * This is performed inside an output buffer to avoid any errors
+			 * that might be thrown by the ReflectionClass constructor.
+			 */
+			try {
+				ob_start();
+				$reflection = new \ReflectionClass( $class_name );
+				ob_end_clean();
+			} catch ( \ReflectionException $e ) {
+				ob_end_clean();
+				continue;
+			}
+
+			// Normalize both paths so symlinks and directory separators do not cause false positives.
+			$reflection_path = wp_normalize_path( $reflection->getFileName() );
+
+			if ( $default_path !== $reflection_path ) {
+				$overridden_classes[ $reflection->getName() ] = $reflection->getFileName();
+			}
+		}
+
+		$result = array(
+			'label'       => __( 'All WordPress Core classes can be properly loaded' ),
+			'status'      => 'good',
+			'badge'       => array(
+				'label' => __( 'Security' ),
+				'color' => 'blue',
+			),
+			'description' => sprintf(
+				'<p>%s</p>',
+				__( 'Plugins and Themes should not override the default WordPress Core classes, as that might lead to unexpected side-effects on your site.' )
+			),
+			'actions'     => '',
+			'test'        => 'core_classes_paths',
+		);
+
+		if ( ! empty( $overridden_classes ) ) {
+			$result['status'] = 'critical';
+			$result['label']  = __( 'WordPress Core classes are being overridden' );
+			$result['description'] .= sprintf(
+				'<p>%s</p>',
+				__( 'The following WordPress Core classes are being overridden:' )
+			);
+
+			$result['description'] .= '<table class="widefat striped health-check-table">';
+			foreach ( $overridden_classes as $class_name => $class_path ) {
+				$result['description'] .= '<tr>';
+				$result['description'] .= '<th><code>' . esc_html( $class_name ) . '</code></th>';
+				$result['description'] .= '<td><code>' . esc_html( $class_path ) . '</code></td>';
+				$result['description'] .= '</tr>';
+			}
+			$result['description'] .= '</table>';
+		}
+
+		return $result;
+	}
+
 	/**
 	 * Tests if the Authorization header has the expected values.
 	 *
@@ -3002,6 +3086,12 @@ public static function get_tests() {
 			);
 		}
 
+		// Check for Core classes being overridden.
+		$tests['direct']['core_classes_paths'] = array(
+			'label' => __( 'Core classes paths' ),
+			'test'  => 'core_classes_paths',
+		);
+
 		/**
 		 * Filters which site status tests are run on a site.
 		 *