{
  "entrypoint_kind": "api_remote",
  "entrypoint_detail": "WordPress wp-login.php?action=lostpassword + POST ?option=smsalert-change-password-form (SMS Alert plugin AJAX-like handler via init hook)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "mariadb",
    "php-builtin-server",
    "wordpress-7.0",
    "woocommerce-10.9.3",
    "sms-alert-3.9.5"
  ],
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/exploit_vuln_step1_response.html",
    "logs/exploit_vuln_step2_response.html",
    "logs/exploit_vuln_step2_headers.txt",
    "logs/exploit_vuln_cookies.txt",
    "logs/exploit_fixed_step1_response.html",
    "logs/exploit_fixed_step2_response.html",
    "logs/exploit_fixed_step2_headers.txt",
    "logs/exploit_fixed_cookies.txt",
    "logs/php-server.log"
  ],
  "notes": "Vulnerable 3.9.5: unauthenticated password reset SUCCEEDED (admin password changed without OTP). Patched 3.9.6: attack BLOCKED (password unchanged). vuln_success=True, fix_blocked=True. Timestamp: 2026-07-05T10:47:31Z"
}