From f93e786f440a8889923c61f4de598c5329e94480 Mon Sep 17 00:00:00 2001
From: salvatorecorsi <86927009+salvatorecorsi@users.noreply.github.com>
Date: Sun, 11 Oct 2026 10:33:39 +0200
Subject: [PATCH] XML-RPC: Honor menu_order when creating and editing posts.

Include menu_order in the existing post field whitelist and document the accepted parameter. Add regression coverage for posts and pages, zero and negative order values, and preservation when omitted from an edit.

See https://core.trac.wordpress.org/ticket/40863.
---
 src/wp-includes/class-wp-xmlrpc-server.php |  2 +
 tests/phpunit/tests/xmlrpc/wp/editPost.php | 58 ++++++++++++++++++++++
 tests/phpunit/tests/xmlrpc/wp/newPost.php  | 35 +++++++++++++
 3 files changed, 95 insertions(+)

diff --git a/src/wp-includes/class-wp-xmlrpc-server.php b/src/wp-includes/class-wp-xmlrpc-server.php
index 9d4ee81cc61e3..a3064a78f12da 100644
--- a/src/wp-includes/class-wp-xmlrpc-server.php
+++ b/src/wp-includes/class-wp-xmlrpc-server.php
@@ -1333,6 +1333,7 @@ protected function _prepare_user( $user, $fields ) {
 	 *         @type string $post_status    Post status. Default 'draft'
 	 *         @type string $post_title     Post title.
 	 *         @type int    $post_author    Post author ID.
+	 *         @type int    $menu_order     Post order. Default 0.
 	 *         @type string $post_excerpt   Post excerpt.
 	 *         @type string $post_content   Post content.
 	 *         @type string $post_date_gmt  Post date in GMT.
@@ -1475,6 +1476,7 @@ protected function _insert_post( $user, $content_struct ) {
 			'post_name'      => null,
 			'post_thumbnail' => null,
 			'post_parent'    => 0,
+			'menu_order'     => 0,
 			'ping_status'    => '',
 			'comment_status' => '',
 			'custom_fields'  => null,
diff --git a/tests/phpunit/tests/xmlrpc/wp/editPost.php b/tests/phpunit/tests/xmlrpc/wp/editPost.php
index dacd64573a6d5..19d0b23b025ab 100644
--- a/tests/phpunit/tests/xmlrpc/wp/editPost.php
+++ b/tests/phpunit/tests/xmlrpc/wp/editPost.php
@@ -30,6 +30,64 @@ public function test_edit_own_post() {
 		$this->assertSame( $new_title, $out->post_title );
 	}
 
+	/**
+	 * @ticket 40863
+	 * @dataProvider data_menu_order
+	 *
+	 * @param string $post_type  Post type.
+	 * @param int    $menu_order Menu order.
+	 */
+	public function test_menu_order( $post_type, $menu_order ) {
+		$editor_id = $this->make_user_by_role( 'editor' );
+		$post_id   = self::factory()->post->create(
+			array(
+				'post_author' => $editor_id,
+				'post_type'   => $post_type,
+				'menu_order'  => 10,
+			)
+		);
+
+		$result = $this->myxmlrpcserver->wp_editPost( array( 1, 'editor', 'editor', $post_id, array( 'menu_order' => $menu_order ) ) );
+
+		$this->assertNotIXRError( $result );
+		$this->assertTrue( $result );
+		$this->assertSame( $menu_order, get_post( $post_id )->menu_order );
+	}
+
+	/**
+	 * Data provider for test_menu_order().
+	 *
+	 * @return array
+	 */
+	public function data_menu_order() {
+		return array(
+			'post'           => array( 'post', 5 ),
+			'page'           => array( 'page', 5 ),
+			'zero order'     => array( 'page', 0 ),
+			'negative order' => array( 'page', -5 ),
+		);
+	}
+
+	/**
+	 * @ticket 40863
+	 */
+	public function test_menu_order_is_preserved_when_omitted() {
+		$editor_id = $this->make_user_by_role( 'editor' );
+		$post_id   = self::factory()->post->create(
+			array(
+				'post_author' => $editor_id,
+				'post_type'   => 'page',
+				'menu_order'  => 10,
+			)
+		);
+
+		$result = $this->myxmlrpcserver->wp_editPost( array( 1, 'editor', 'editor', $post_id, array( 'post_title' => 'Updated title' ) ) );
+
+		$this->assertNotIXRError( $result );
+		$this->assertTrue( $result );
+		$this->assertSame( 10, get_post( $post_id )->menu_order );
+	}
+
 	public function test_capable_edit_others_post() {
 		$contributor_id = $this->make_user_by_role( 'contributor' );
 		$this->make_user_by_role( 'editor' );
diff --git a/tests/phpunit/tests/xmlrpc/wp/newPost.php b/tests/phpunit/tests/xmlrpc/wp/newPost.php
index c6386a1f23d5b..2f9977c308de3 100644
--- a/tests/phpunit/tests/xmlrpc/wp/newPost.php
+++ b/tests/phpunit/tests/xmlrpc/wp/newPost.php
@@ -37,6 +37,41 @@ public function test_basic_content() {
 		$this->assertStringMatchesFormat( '%d', $result );
 	}
 
+	/**
+	 * @ticket 40863
+	 * @dataProvider data_menu_order
+	 *
+	 * @param string $post_type  Post type.
+	 * @param int    $menu_order Menu order.
+	 */
+	public function test_menu_order( $post_type, $menu_order ) {
+		$this->make_user_by_role( 'editor' );
+
+		$post   = array(
+			'post_title' => 'Menu order test',
+			'post_type'  => $post_type,
+			'menu_order' => $menu_order,
+		);
+		$result = $this->myxmlrpcserver->wp_newPost( array( 1, 'editor', 'editor', $post ) );
+
+		$this->assertNotIXRError( $result );
+		$this->assertSame( $menu_order, get_post( $result )->menu_order );
+	}
+
+	/**
+	 * Data provider for test_menu_order().
+	 *
+	 * @return array
+	 */
+	public function data_menu_order() {
+		return array(
+			'post'           => array( 'post', 5 ),
+			'page'           => array( 'page', 5 ),
+			'zero order'     => array( 'page', 0 ),
+			'negative order' => array( 'page', -5 ),
+		);
+	}
+
 	public function test_ignore_id() {
 		$this->make_user_by_role( 'author' );