Uncaught Error: Class 'ParagonIE_Sodium_Core32_Curve25519' not found

[x-Felix]

PHP Fatal error: Uncaught Error: Class 'ParagonIE_Sodium_Core32_Curve25519' not found in /wordpress/wp-includes/sodium_compat/src/Core32/Ed25519.php:10\nStack trace:\n#0 {main}\n thrown in /wordpress/wp-includes/sodium_compat/src/Core32/Ed25519.php on line 10, referer: http://example.com/wp-includes/sodium_compat/src/Core32/Ed25519.php

I saw lot of error messages in Apache log.
wordpress 5.9.2. Not really have idea what triggers the php error.

[paragonie-security]

That looks like an autoloader bug. What version of PHP are you running?

Try adding this snippet at the top of wp-includes/sodium_compat/src/Core32/Ed25519.php:

if (!class_exists('ParagonIE_Sodium_Core32_Curve25519')) {
    require_once dirname(__FILE__) . '/Curve25519.php';
}

If that doesn't fix it, restart your webserver.

[x-Felix]

Thanks. My php version is 7.4.28.
I added the line and haven’t seen error message yet.

[paragonie-security]

Okay, I'll add this in #145 and do a new point release this week so the fix is official.

In the meantime, if anyone wants to try to identify the actual cause of the autoloader bug, that might make for an interesting write-up.

[bporcelli]

@paragonie-security For what it's worth the only way I've been able to reproduce this is by accessing the file /wp-includes/sodium_compat/src/Core32/Ed25519.php directly (which makes sense, since the autoloader won't be loaded in that case). As far as I can tell this doesn't happen when sodium_compat is loaded correctly.

Perhaps it's an attempt at "google dorking" as leonardorodriguez guesses in https://wordpress.org/support/topic/sodium-compact-security-hole-maybe-google-dorking/ 🤔