{
  "verdict": "no_distinct_variant_confirmed",
  "confirmed": false,
  "bypass_confirmed": false,
  "alternate_trigger_confirmed": false,
  "created_at": "2026-07-05T17:13:10Z",
  "repository": "https://wpreviewslider.com//WP Review Slider Pro",
  "tested_product": {
    "name": "WP Review Slider Pro (Premium)",
    "version": "12.6.7",
    "source_kind": "commercial_zip_in_repro_bundle",
    "sha256": "7f6092f4ea58b5c5c0dba72ba014b9395bf9608f9aeeb95206e80dc14f0b17e5"
  },
  "fixed_control": {
    "kind": "line_accurate_patch_from_repro_stage",
    "description": "Same WP Review Slider Pro 12.6.7 source with notinstring CSV elements cast through absint() before constructing id NOT IN (...). Official 12.7.3 source was unavailable in the bundle.",
    "patch_artifact": "bundle/logs/vuln_variant/variant_notinstring_patch.diff"
  },
  "parent_validation": {
    "original_payload_reproduced_before_patch": true,
    "original_payload_blocked_after_patch": true,
    "vulnerable_seconds": 3.109833,
    "fixed_seconds": 0.044909,
    "threshold_delay_seconds": 2.5,
    "threshold_fast_seconds": 1.5
  },
  "candidate_results": [
    {
      "candidate": "textsource",
      "entrypoint": "POST /wp-admin/admin-ajax.php action=wprp_load_more_revs field=textsource",
      "runtime_seconds_after_notin_patch": 0.01589,
      "result": "blocked_no_delay"
    },
    {
      "candidate": "textsearch",
      "entrypoint": "POST /wp-admin/admin-ajax.php action=wprp_load_more_revs field=textsearch",
      "runtime_seconds_after_notin_patch": 0.015887,
      "result": "blocked_no_delay"
    },
    {
      "candidate": "textlang",
      "entrypoint": "POST /wp-admin/admin-ajax.php action=wprp_load_more_revs field=textlang",
      "runtime_seconds_after_notin_patch": 0.015,
      "result": "blocked_no_delay"
    },
    {
      "candidate": "textrtype",
      "entrypoint": "POST /wp-admin/admin-ajax.php action=wprp_load_more_revs field=textrtype",
      "runtime_seconds_after_notin_patch": 0.01684,
      "result": "blocked_no_delay"
    },
    {
      "candidate": "shortcodepageid",
      "entrypoint": "POST /wp-admin/admin-ajax.php action=wprp_load_more_revs field=shortcodepageid",
      "runtime_seconds_after_notin_patch": 0.014518,
      "result": "blocked_no_delay"
    }
  ],
  "blocking_mitigation": "The notinstring patch neutralizes the unquoted numeric NOT IN sink. Reviewed alternate string-filter candidates did not execute SQL timing payloads on the fixed control; response dbcall evidence shows attempted quote breaks escaped in string contexts.",
  "claim_block_reason": "No tested materially distinct candidate crossed the same public HTTP trust boundary and produced SQL injection on the fixed control.",
  "evidence": {
    "reproduction_log": "bundle/logs/vuln_variant/reproduction_steps.log",
    "evidence_log": "bundle/logs/vuln_variant/variant_evidence.log",
    "timing_summary": "bundle/vuln_variant/artifacts/variant_timing_summary.json",
    "candidate_matrix": "bundle/vuln_variant/artifacts/candidate_matrix.json",
    "patch_diff": "bundle/logs/vuln_variant/variant_notinstring_patch.diff",
    "runtime_manifest": "bundle/vuln_variant/runtime_manifest.json"
  }
}