I have a very strange situation that I cannot find any evidence of in other forums, or anywhere else online.
I have a form that when submitted, creates a custom post, and registers a user (using the register user addon). There is then another form for signed in users, which is equivalent, except it does not register the user of course, and does not include the fields relevant to that. The form also adds a bunch of custom fields/post metadata to the custom post.
This is the situation:
User A filled registered on the site and created a custom post - the post title did not get captured correctly and thus was assigned the name 'untitled_1'. The post seemingly had the post ID of 4533 (I will explain why 'seemingly'. I can see all of this data, except for the post ID, in an audit trail plugin that shows such information.
The next day, a returning user filled in the equivalent form for logged in users, and in this case coincidently the post title also was not captured correctly, and the post was also assigned a title of 'untitled_1'. Now it seems that this custom post was also assigned the ID of 4533 - which obviously should never happen, even if the original 4533 had been deleted, right?
From the times n the audit trail, and the times of adjacent posts (4532, 4534, 4535 etc.), it looks as though post 4533 was created the first time by that first new user. There is also a post revision saved shortly after I reckon the original was created, and this revision is timestamped before the now current version of post 4533 was created - this is also obviously not supposed to be possible (a revision being dated prior to the original).
The biggest issue now is that these posts are private, but because the same post ID was used on the second post, all of the custom field data from the first was associated with it, therefore pulling in custom field data from another user on the front end of the site.
So the questions really are:
Should Wordpress ever be able to create a post with an ID that has been used before?
Since it seems that this did occur, how did it happen?
Could it be as a result of the coincidentally same titles ('untitled_1')?
Is there something about the way posts are created by gravity forms that allowed for this to happen?
How can I protect against this in future?
Any insight at all would be greatly appreciated!