WP blog picks up tags from around the fediverse

[bocops]

Quick summary

Approximately two weeks after publishing a single post on my new Wordpress blog, the list of tags contains multiple entries that I did not use in the post. I recognize some tags from the description of my own Mastodon accounts that follow the blog, but others are completely random (and some of them all kinds of racist/NSFW/...). The single post has not been interacted that much, so I'm not sure if all of them are from other fediverse accounts known to the plugin, or if there's some other mechanism at play here.

I feel that this should be considered a bug rather than intended behaviour, because it leads to a very polluted tag list. Also, it changes the resulting page when visiting, say, example.blog/tag/cannabis or example.blog/tag/some_racial_slur from the standard 404 page to a "nothing was found" search result page.

Steps to reproduce

Assuming that nothing is special about my WP/plugin installation, just visit the tags admin page at /wp-admin/edit-tags.php?taxonomy=post_tag and compare the tags listed there to your blog's actual content.

Plugin version is currently 4.7.1.

Site owner impact

Fewer than 20% of the total website/platform users

Severity

Moderate

What other impact(s) does this issue have?

No revenue impact

If a workaround is available, please outline it here.

No response

[bocops]

I now found a single Mastodon account with all the tags I could not trace back to one of my own accounts in its "bio". This account is not currently following my blog, but I guess it could have followed/unfollowed, or liked/unliked the individual post, without me noticing.

In any case, what must have happened is that the AP Actor object for that Mastodon account was seen by my blog, and its summary property was processed, interpreting hashtags in it as tags that should be added to my blog.

I quickly scanned the code and could not find any occurrence of wp_create_* that might be responsible, but I probably don't know enough about existing WP functions to perform a really thorough search.