Support » Fixing WordPress » 404 template never called – not found shows all pages (major security issue)

  • I have some blogs that I’m upgrading to wordpress 2.5. One of them has a custom homepage set in options > reading. On this blog writing a wrong url in the address fields make all the pages defined in the blog to come up one after another. I don’t have password-protected pages, but I think they’re coming out also… The 404 template is not called.
    Setting no custom homepage solves the problem, but please a fix is needed. Thanks.

Viewing 15 replies - 1 through 15 (of 17 total)
  • I need to add that the is_404() function always returns false.

    Does your theme have an actual 404.php page?

    Yes I have it.

    No one has any idea on how to fix it?

    I’m not sure what you mean by “writing a wrong url in the address fields”. What address fields are you referring to?

    The browser address bar. Say I go to “”, on there’s wordpress 2.5, “a” isn’t the name of any wordpress’ page and in wordpress I selected to have a static home page instead of the last posts, then I will see all the pages defined in the wordpress installation on “”.
    In fact I discovered this because I tried to access my admin and pushed return after only writing “wp” (never completely trust autocompletes 😀 ).


    I am having the same issue.

    and you will see what the problem is.

    I have a 404.php page in my theme and this is a fresh WordPress 2.5 install. I also am using a static page for the home page of the site.

    I tried to switch to the default theme to see if it was an issue with my theme, but it was not.

    My .htaccess looks the same as another site I am using with a similar setup (that is still on 2.3) that is working just fine.

    Any help much appreciated.

    This bug shows up when the “Posts” page isn’t set. Try this:

    1. Create a new page for your posts
    2. Go to the Settings – Reading page
    3. Select your new page from the “Posts page” dropdown list

    Hope that helps…

    That seems to have fixed it.

    I just created a page called “404 Fix” that will not be linked to.

    This fixed mine, also.
    Thanks, natecook!

    As a follow-up, can someone explain what the “Posts page” is for?

    (Not necesasry … extra credit work for you eager pupils.) 😉

    Thanks for sharing that fix natecook, I just spent an hour scratching my head on this bug.

    I hope it is a bug, not a ‘feature’. ;p

    So I guess this was NOT fixed in 2.5.1?

    I am not having luck with this fix. My WP 2.5 site has a 404 template. Previously, creating a bogus URL would generate a long running output with a concatenation of every page on my site. With this fix, (creating an unused Page and pointing the Post Pages menu to it, I get a blank (no HTML in the source) return page.

    This site is a bit out of the usual structure – all the content pieces are WP page, there are now no Posts. I create a dummy post, yet I still get a blank for what should be my 404 template.

    For TryoCawley – I do sites that do not put typical blog chronology on the front gae- I set the main front page to point at an existing WP page as the entry way tot he site. I would use a Posts Page as one templated to do a more traditional blog-like output on an internal page.

    Never mind — the less than stellar template I am using had an extraneuos php endif statement

Viewing 15 replies - 1 through 15 (of 17 total)
  • The topic ‘404 template never called – not found shows all pages (major security issue)’ is closed to new replies.