repository=https://github.com/WordPress/wordpress-develop.git
vulnerable_commit=18f793b1f16c1b15b0fc37027f4aeaefab0bfe02
fixed_commit=855551c4477bd5a0407221c57dae123c4163b434
latest_commit=ace9192af868524bdc49cf4fcb91f4c12c73ee5f
remote_trunk=ace9192af868524bdc49cf4fcb91f4c12c73ee5f
fixed_object=855551c4477bd5a0407221c57dae123c4163b434 fixed_date=2026-07-17T17:58:37Z fixed_subject=Tag 7.0.2
latest_object=ace9192af868524bdc49cf4fcb91f4c12c73ee5f latest_date=2026-07-17T19:26:54Z latest_subject=Post WordPress 7.1 Beta 2 version bump.
fixed_contains_batch_alignment=1
latest_contains_batch_alignment=1
fixed_contains_nested_dispatch_guard=4
latest_contains_nested_dispatch_guard=4
fixed_contains_author_id_normalization=1
latest_contains_author_id_normalization=1
serve_request_call_sites_latest:
ace9192af868524bdc49cf4fcb91f4c12c73ee5f:src/wp-includes/rest-api.php:488:	$server->serve_request( $route );
installed_with_unrecoverable_random_owner_password=true
installed_with_unrecoverable_random_owner_password=true
label=vulnerable
wordpress_version=7.0.1
wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5
wordpress_mounts=[{"Type":"volume","Name":"b9ab122e6ce8dec7ffcd57a1ad58622ea462c4f8d87806614bf2f292b8e8ddc5","Source":"/var/lib/docker/volumes/b9ab122e6ce8dec7ffcd57a1ad58622ea462c4f8d87806614bf2f292b8e8ddc5/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}]
user_count=1
post_count=4
oembed_count=0
local_infile=0
label=fixed
wordpress_version=7.0.2-src
wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5
wordpress_mounts=[{"Type":"volume","Name":"112bd61150c0a3ab25a8a9f76eb04053a8fea5baccbf052ee3188514ad8fbacf","Source":"/var/lib/docker/volumes/112bd61150c0a3ab25a8a9f76eb04053a8fea5baccbf052ee3188514ad8fbacf/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}]
user_count=1
post_count=4
oembed_count=0
local_infile=0
{"http_status": 207, "marker": "PRUVA-VARIANT-ROW-MARKER", "marker_reflected": false, "mode": "body_scalar", "response_codes": ["parse_path_failed", "rest_batch_not_allowed", "rest_invalid_handler"], "response_excerpt": "{\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": {\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": [{\"_links\": {\"about\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/types/post\"}], \"author\": [{\"embeddable\": true, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/users/1\"}], \"collection\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/posts\"}], \"curies\": [{\"href\": \"https://api.w.org/{rel}\", \"name\": \"wp\", \"templated\": true}], \"replies\": [{\"embeddable\": true, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/comments?post=1\"}], \"self\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/posts/1\", \"targetHints\": {\"allow\": [\"GET\"]}}], \"version-history\": [{\"count\": 0, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/posts/1/revisions\"}], \"wp:attachment\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/media?parent=1\"}], \"wp:term\": [{\"embeddable\": true, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/categories?post=1\", \"taxonomy\": \"category\"}, {\"embeddable\": true, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/ta"}
{"http_status": 207, "marker": "PRUVA-VARIANT-ROW-MARKER", "marker_reflected": false, "mode": "body_scalar", "response_codes": ["parse_path_failed", "rest_batch_not_allowed", "rest_cannot_create"], "response_excerpt": "{\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": {\"code\": \"rest_cannot_create\", \"data\": {\"status\": 401}, \"message\": \"Sorry, you are not allowed to create posts as this user.\"}, \"headers\": {\"Allow\": \"GET\"}, \"status\": 401}, {\"body\": {\"code\": \"rest_batch_not_allowed\", \"data\": {\"status\": 400}, \"message\": \"The requested route does not support batch requests.\"}, \"headers\": {\"Allow\": \"POST\"}, \"status\": 400}]}"}
{"http_status": 207, "marker": "PRUVA-VARIANT-ROW-MARKER", "marker_reflected": true, "mode": "query_scalar", "response_codes": ["parse_path_failed", "rest_batch_not_allowed", "rest_invalid_handler"], "response_excerpt": "{\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": {\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": [{\"_links\": {\"about\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/types/post\"}], \"collection\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/posts\"}], \"curies\": [{\"href\": \"https://api.w.org/{rel}\", \"name\": \"wp\", \"templated\": true}], \"replies\": [{\"embeddable\": true, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/comments?post=424242\"}], \"self\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/posts/424242\", \"targetHints\": {\"allow\": [\"GET\"]}}], \"version-history\": [{\"count\": 0, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/posts/424242/revisions\"}], \"wp:attachment\": [{\"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/media?parent=424242\"}], \"wp:term\": [{\"embeddable\": true, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/categories?post=424242\", \"taxonomy\": \"category\"}, {\"embeddable\": true, \"href\": \"http://pruva-vv-63030-17843822991378-vuln/wp-json/wp/v2/tags?post=424242\", \"taxonomy\": \"post_tag\"}]}, \"author\": 0, \"categories\": [], \"class_li"}
{"http_status": 207, "marker": "PRUVA-VARIANT-ROW-MARKER", "marker_reflected": false, "mode": "query_scalar", "response_codes": ["parse_path_failed", "rest_batch_not_allowed", "rest_cannot_create"], "response_excerpt": "{\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": {\"code\": \"rest_cannot_create\", \"data\": {\"status\": 401}, \"message\": \"Sorry, you are not allowed to create posts as this user.\"}, \"headers\": {\"Allow\": \"GET\"}, \"status\": 401}, {\"body\": {\"code\": \"rest_batch_not_allowed\", \"data\": {\"status\": 400}, \"message\": \"The requested route does not support batch requests.\"}, \"headers\": {\"Allow\": \"POST\"}, \"status\": 400}]}"}
{"http_status": 207, "marker": "PRUVA-VARIANT-ROW-MARKER", "marker_reflected": false, "mode": "batch_alignment", "response_codes": ["parse_path_failed", "rest_cannot_create_user", "rest_missing_callback_param"], "response_excerpt": "{\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": {\"code\": \"rest_cannot_create_user\", \"data\": {\"status\": 401}, \"message\": \"Sorry, you are not allowed to create new users.\"}, \"headers\": {\"Allow\": \"GET\"}, \"status\": 401}, {\"body\": {\"code\": \"rest_missing_callback_param\", \"data\": {\"params\": [\"username\", \"email\", \"password\"], \"status\": 400}, \"message\": \"Missing parameter(s): username, email, password\"}, \"headers\": [], \"status\": 400}]}"}
{"http_status": 207, "marker": "PRUVA-VARIANT-ROW-MARKER", "marker_reflected": false, "mode": "batch_alignment", "response_codes": ["parse_path_failed", "rest_cannot_create", "rest_missing_callback_param"], "response_excerpt": "{\"responses\": [{\"body\": {\"code\": \"parse_path_failed\", \"data\": {\"status\": 400}, \"message\": \"Could not parse the path.\"}, \"headers\": [], \"status\": 400}, {\"body\": {\"code\": \"rest_cannot_create\", \"data\": {\"status\": 401}, \"message\": \"Sorry, you are not allowed to create posts as this user.\"}, \"headers\": {\"Allow\": \"GET\"}, \"status\": 401}, {\"body\": {\"code\": \"rest_missing_callback_param\", \"data\": {\"params\": [\"username\", \"email\", \"password\"], \"status\": 400}, \"message\": \"Missing parameter(s): username, email, password\"}, \"headers\": {\"Allow\": \"GET\"}, \"status\": 400}]}"}
label=vulnerable
wordpress_version=7.0.1
wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5
wordpress_mounts=[{"Type":"volume","Name":"b9ab122e6ce8dec7ffcd57a1ad58622ea462c4f8d87806614bf2f292b8e8ddc5","Source":"/var/lib/docker/volumes/b9ab122e6ce8dec7ffcd57a1ad58622ea462c4f8d87806614bf2f292b8e8ddc5/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}]
user_count=1
post_count=4
oembed_count=0
local_infile=0
label=fixed
wordpress_version=7.0.2-src
wordpress_image=wordpress:7.0.1-php8.2-apache@sha256:bfc320ed4f02dd3939186b8020de64203a48a939d6dedcf44cb92cf2368923f5
wordpress_mounts=[{"Type":"volume","Name":"112bd61150c0a3ab25a8a9f76eb04053a8fea5baccbf052ee3188514ad8fbacf","Source":"/var/lib/docker/volumes/112bd61150c0a3ab25a8a9f76eb04053a8fea5baccbf052ee3188514ad8fbacf/_data","Destination":"/var/www/html","Driver":"local","Mode":"","RW":true,"Propagation":""}]
user_count=1
post_count=4
oembed_count=0
local_infile=0
candidate_1=body_scalar_alternate_data_path vulnerable_marker=false fixed_marker=false
candidate_2=query_scalar_original_sink_control vulnerable_marker=true fixed_marker=false
candidate_3=batch_alignment_alternate_error_position inspected_runtime_and_source=true
latest_revision=ace9192af868524bdc49cf4fcb91f4c12c73ee5f guards_retained=true
verdict=no_distinct_variant_or_bypass
[-] NO DISTINCT VARIANT/BYPASS: 7.0.2 blocks both scalar locations; trunk retains all three guards