Customizer color sanitization crashes when preview value is an array

[pirate-bot]

Summary

Customizer preview can terminate with a TypeError when a color setting is submitted as an array.

Expected behavior: invalid or unexpected color-setting input is handled without crashing the preview request.

Actual behavior: the request fails with strpos(): Argument #1 ($haystack) must be of type string, array given.

Impact: affected Customizer preview requests cannot complete while the malformed setting value is present.

Customer context

• Product / area: Neve Customizer color settings
• Version: 4.2.10
• Environment: WordPress 7.0.2; PHP 8.2.33
• Integration / third party: Not provided
• Reported error / symptom: TypeError: strpos(): Argument #1 ($haystack) must be of type string, array given
• Impact: Production telemetry recorded 15 crashes across one site in the query window; the request context was frontend and the stack was in Customizer preview.

Reproduction notes

1. Open a Neve Customizer preview containing a color setting that uses neve_sanitize_colors.
2. Submit an array-shaped value for that setting during preview.
3. Observed production result: the preview request reaches the sanitizer and terminates with strpos(): Argument #1 ($haystack) must be of type string, array given.

The exact setting and client-side steps that produced the array were not captured by telemetry.

Diagnosis

Conclusion

Production telemetry captures an uncaught TypeError at neve_sanitize_colors() while WordPress is sanitizing a Customizer preview value. In the inspected 4.2.10 source, the callback immediately calls strpos() on its unvalidated argument, so an array reaches the reported PHP type error. This is a confirmed Neve core defect, not Themeisle SDK code.

Where this likely occurs

• globals/sanitize-functions.php — neve_sanitize_colors() lines 19-35 accepts $value but calls strpos( $value, 'var' ) at line 20 before any type validation; later branches also assume a string.
• inc/customizer/base_customizer.php — Base_Customizer::add_* control setup lines 443-463 and 466-484 registers neve_sanitize_colors as the sanitize_callback for React Customizer color controls.
• The telemetry stack reaches the callback through WP_Customize_Manager preview sanitization. The exact setting identifier and submitted payload were not captured.
• functions.php — version declaration line 11 identifies the inspected release as 4.2.10. Repository history indicates the same sanitizer implementation exists at tag v4.2.10 (ba996594302); the missing outer input guard predates this release.

Engineering notes

• The callback is also registered by multiple core header/footer and Customizer color controls, so the recorded failure is not limited by code structure to one visible color control; affected settings still require array-shaped input to reach this path.
• The sibling Pro add-on registers this core callback for additional controls but does not define it. The captured failure location is in the Neve core repository, so routing is Codeinwp/neve.
• The supplied stack is production evidence that the Customizer sanitization callback received an array. WordPress core source was not inspected; its internal type or value-normalization behavior is not asserted beyond the captured stack.

Test coverage status

No relevant neve_sanitize_colors coverage was found during inspection in the Neve tests PHP files. No targeted runtime test was run because the production stack trace and inspected source provide direct confirmation.

What to verify or explore next

• May be worth reproducing a Customizer preview request with an array submitted for a core color setting and confirming the affected preview behavior on PHP 8.2.
• May be worth checking registered color controls in both core and the Pro add-on for array-shaped preview payloads.
• May be worth adding or locating coverage for invalid scalar versus array input to this sanitizer.

Unknowns / follow-up

• Telemetry does not identify which Customizer setting or client-side workflow supplied the array.
• The available evidence covers Neve 4.2.10 on one observed site; broader version and PHP-version prevalence is unknown.

Confidence

Confidence: 98/100

Production telemetry records 15 occurrences of the same uncaught TypeError in Neve 4.2.10, and the reported source line directly passes an unvalidated value to strpos(). The affected callback is registered for Customizer color settings, matching the captured Customizer preview stack.

Crash telemetry

Occurrences	15
Distinct sites	1
First seen	2026-08-06 06:46 UTC
Last seen	2026-08-06 06:52 UTC
Crash location	product:globals/sanitize-functions.php:20
Request context	frontend
Inside Themeisle SDK	no
Product versions	4.2.10
WP versions	7.0.2
PHP versions	8.2.33
SDK versions	3.3.59

---

Source: automated crash report — neve, fingerprint f064520c4fde745445dea9371f4e9e45
Generated by bug-report-triage (ID: bug-report-triage_6a757493c11b86.06193548)