in admin-post.php the actions are evaluate in an impossible situation:
$action = empty( $_REQUEST[‘action’] ) ? ” : $_REQUEST[‘action’];
if ( ! wp_validate_auth_cookie() ) {
if ( empty( $action ) ) {
/**
* Fires on a non-authenticated admin post request where no action was supplied.
*
* @since 2.6.0
*/
do_action( ‘admin_post_nopriv’ );
} else {
/**
* Fires on a non-authenticated admin post request for the given action.
*
* The dynamic portion of the hook name, $action
, refers to the given
* request action.
*
* @since 2.6.0
*/
do_action( “admin_post_nopriv_{$action}” );
}
} else {
if ( empty( $action ) ) {
/**
* Fires on an authenticated admin post request where no action was supplied.
*
* @since 2.6.0
*/
do_action( ‘admin_post’ );
} else {
/**
* Fires on an authenticated admin post request for the given action.
*
* The dynamic portion of the hook name, $action
, refers to the given
* request action.
*
* @since 2.6.0
*/
do_action( “admin_post_{$action}” );
}
}