{
  "variant_outcome": "no_bypass",
  "claim_block_reason": "fix_covers_all_alternate_entry_points",
  "validated_surface": "api_remote",
  "evidence_scope": "production_path",
  "claimed_impact_class": "sql_injection",
  "observed_impact_class": "no_bypass_time_based_sqli_on_fixed",
  "exploitability_confidence": "high",
  "attacker_controlled_input": "premmerce_wishlist cookie (JSON array of wishlist keys) with embedded x\") UNION SELECT SLEEP(5),... payload, sent to four distinct unauthenticated entry points",
  "trigger_path": "cookie -> WishlistStorage::cookieGet() -> WishlistModel::getWishlistsByKeys()/getDefaultWishlistByKeys() (concatenation sink on vuln; parameterized + regex-filtered on fixed)",
  "end_to_end_target_reached": true,
  "sanitizer_used": false,
  "crash_observed": false,
  "read_write_primitive_observed": false,
  "exploit_chain_demonstrated": false,
  "blocking_mitigation": "1.1.12 cookieGet() regex ^[a-zA-Z0-9]{1,13}$ on every cookie key + full $wpdb->prepare() parameterization of all WishlistModel sinks (getWishlistsByKeys, getDefaultWishlistByKeys, setUserToWishlistsByKeys, deleteWishlists, getWishlistsByProductId, getWishlists where_in allow-list). Covers REST /add/popup, wc-ajax popup, REST /add POST, frontend wishlist page, and the wp_login assignUserWishlistFromCookie UPDATE path.",
  "inferred": false,
  "candidate_results": {
    "vulnerable_1111_sleep_seconds": {
      "c0_baseline_add_popup_GET": 5.19668,
      "c1_wc_ajax_popup_GET": 6.053645,
      "c2_rest_add_POST": 5.156079,
      "c3_page_render_GET": 5.138215
    },
    "fixed_1112_sleep_seconds": {
      "c0_baseline_add_popup_GET": 0.107576,
      "c1_wc_ajax_popup_GET": 0.042549,
      "c2_rest_add_POST": 0.074162,
      "c3_page_render_GET": 0.103984
    },
    "latest_1113_sleep_seconds": {
      "c0_baseline_add_popup_GET": 0.120578,
      "c1_wc_ajax_popup_GET": 0.04077,
      "c2_rest_add_POST": 0.075403,
      "c3_page_render_GET": 0.099767
    }
  },
  "vulnerable_baseline_c0_sleeps": true,
  "bypass_on_fixed_or_latest": false
}