In reply to Aaron D. Campbell.

Hi Aaron,
Thanks for taking the time to reply. I think the most substantive issue (I appreciate your replies on all points) is whether or not it’s really the case that using a virtual host is promoted as best practice (and if so, if that promotion is something anyone’s aware of), or that its absence is poor configuration, even on single-site servers.
Concerning its prevalance, you say that you talked to shared hosts, but that excludes the single-site-on-a-server case by definition. I think (intuitively – i.e. no hard figures) that it’s disproportionately going to be larger sites, mass-readership sites, and enterprise sites, things in that territory, that are having one site only on the server, and likely to be vulnerable. You say that using VirtualHost directives in Apache is “definitely best practice” even if you are only hosting a single site, which is equivalent to the previous statement that failing to do so is a poor configuration, but I’m very curious as to where this comes from. I’ve been working with Apache for 20 years, and I cannot recall ever seeing this suggested. As phrased, it appears to have been critical to the determination that this issue is of relatively low importance. It’s not a viewpoint reflected anywhere in the Apache documentation, AFAICT.
Note that WPTavern – owned by Matt Mullenwegg – doesn’t care about the HTTP host header, so apparently isn’t using virtual hosting in the way you’re saying everyone should; the line below will return you the site:
curl -H ‘Host: anything.at.all’ https://wptavern.com
So, if allowing requests not coming via a specific virtual host indicates a poor setup – well, even Matt has trouble with this, by the looks of it.
I am somewhat interested in how the PHP 5.2 thing plays out. On the PHP 5.2 support issue, WP core devs have taken the view that users can’t be held responsible for their hosting setup, and so therefore it’s the duty of WP to work with that and support that antique. You’ve said what seems to be the opposite – “We would consider that a poor server configuration … which is unfortunately outside our control.” – i.e. if users are lumbered with a sub-optimal server setup, then no extra responsibility devolves upon WP devs because of that. It would seem reasonable if in security issues, more onus came onto WP devs, rather than less, though.
I suppose it’ll be interesting to see what actually now happens in the real world – if attackers go for this. I can prattle about theory all night! ?
David