From cb86db135d20d481ab27b9bc4da172b71197ac6d Mon Sep 17 00:00:00 2001
From: ArkaPrabhaChowdhury <arkopra@gmail.com>
Date: Mon, 27 Jul 2026 13:59:49 +0530
Subject: [PATCH] Administration: Use a unique nonce for Find Posts

---
 src/js/_enqueues/admin/media.js                |  2 +-
 src/wp-admin/includes/template.php             |  2 +-
 tests/phpunit/tests/admin/includesTemplate.php | 14 ++++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/js/_enqueues/admin/media.js b/src/js/_enqueues/admin/media.js
index db61220b50e5f..294456ff611e1 100644
--- a/src/js/_enqueues/admin/media.js
+++ b/src/js/_enqueues/admin/media.js
@@ -106,7 +106,7 @@
 			var post = {
 					ps: $( '#find-posts-input' ).val(),
 					action: 'find_posts',
-					_ajax_nonce: $('#_ajax_nonce').val()
+					_ajax_nonce: $( '#_ajax_nonce-find-posts' ).val()
 				},
 				spinner = $( '.find-box-search .spinner' );
 
diff --git a/src/wp-admin/includes/template.php b/src/wp-admin/includes/template.php
index bafd5f0904769..eca6a98b2b339 100644
--- a/src/wp-admin/includes/template.php
+++ b/src/wp-admin/includes/template.php
@@ -2043,7 +2043,7 @@ function find_posts_div( $found_action = '' ) {
 					<input type="hidden" name="found_action" value="<?php echo esc_attr( $found_action ); ?>" />
 				<?php } ?>
 				<input type="hidden" name="affected" id="affected" value="" />
-				<?php wp_nonce_field( 'find-posts', '_ajax_nonce', false ); ?>
+				<?php wp_nonce_field( 'find-posts', '_ajax_nonce-find-posts', false ); ?>
 				<label class="screen-reader-text" for="find-posts-input">
 					<?php
 					/* translators: Hidden accessibility text. */
diff --git a/tests/phpunit/tests/admin/includesTemplate.php b/tests/phpunit/tests/admin/includesTemplate.php
index 4b9b8bc68034e..51a317c2b47c7 100644
--- a/tests/phpunit/tests/admin/includesTemplate.php
+++ b/tests/phpunit/tests/admin/includesTemplate.php
@@ -14,6 +14,20 @@ public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
 		self::$editor_id = $factory->user->create( array( 'role' => 'editor' ) );
 	}
 
+	/**
+	 * @ticket 43611
+	 *
+	 * @covers ::find_posts_div
+	 */
+	public function test_find_posts_div_has_unique_nonce_field() {
+		ob_start();
+		find_posts_div();
+		$output = ob_get_clean();
+
+		$this->assertStringContainsString( 'id="_ajax_nonce-find-posts"', $output );
+		$this->assertStringNotContainsString( 'id="_ajax_nonce"', $output );
+	}
+
 	/**
 	 * @ticket 51137
 	 * @dataProvider data_wp_terms_checklist_with_selected_cats