From 547a5890bfb241040ec548f3c82e68372017cb17 Mon Sep 17 00:00:00 2001
From: YvesCesar <yvesamorim73@gmail.com>
Date: Tue, 29 Sep 2026 17:18:34 -0400
Subject: [PATCH] fix: deny php execution inside vendor folders under
 wp-content

Signed-off-by: YvesCesar <yvesamorim73@gmail.com>
---
 .docker/wordpress-nginx/default.conf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.docker/wordpress-nginx/default.conf b/.docker/wordpress-nginx/default.conf
index 4899d9d..903684f 100644
--- a/.docker/wordpress-nginx/default.conf
+++ b/.docker/wordpress-nginx/default.conf
@@ -22,6 +22,10 @@ server {
         try_files $uri $uri/ /index.php$is_args$args;
     }
 
+    location ~* ^/wp-content/.*/vendor(-bin)?/.*\.php$ {
+        deny all;
+    }
+
     location ~ \.php$ {
         try_files $uri =404;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;