{
  "schema_version": 1,
  "parent_claim": "WordPress 7.0.1 unauthenticated REST batch chain to fresh administrator creation and code execution",
  "root_cause_components": [
    {
      "component": "batch_request_match_desynchronization",
      "anchor": "src/wp-includes/rest-api/class-wp-rest-server.php:serve_batch_request_v1",
      "required_for_parent_chain": true,
      "fixed_in_7_0_2": true,
      "latest_guard_present": true
    },
    {
      "component": "scalar_author_not_in_sql_injection",
      "anchor": "src/wp-includes/class-wp-query.php:WP_Query::get_posts",
      "required_for_parent_chain": true,
      "fixed_in_7_0_2": true,
      "latest_guard_present": true
    },
    {
      "component": "nested_top_level_rest_dispatch",
      "anchor": "src/wp-includes/rest-api.php:rest_api_loaded and WP_REST_Server::serve_request",
      "required_for_parent_chain": true,
      "fixed_in_7_0_2": true,
      "latest_guard_present": true
    }
  ],
  "candidate_equivalence": [
    {
      "candidate_id": "body_scalar_alternate_data_path",
      "same_trust_boundary": true,
      "intended_same_sink": true,
      "sink_reached_on_vulnerable": false,
      "sink_reached_on_fixed": false,
      "same_root_cause_confirmed": false,
      "reason": "The shifted GET posts handler did not consume author_exclude from the body as the needed query parameter."
    },
    {
      "candidate_id": "query_scalar_parent_primitive_control",
      "same_trust_boundary": true,
      "same_sink": true,
      "sink_reached_on_vulnerable": true,
      "sink_reached_on_fixed": false,
      "same_root_cause_confirmed": true,
      "distinct_variant": false,
      "reason": "This is the disclosed parent primitive, retained only as a live positive control."
    },
    {
      "candidate_id": "alternate_malformed_batch_placement",
      "same_trust_boundary": true,
      "same_batch_root_cause": true,
      "handler_shift_observed_on_vulnerable": true,
      "handler_shift_observed_on_fixed": false,
      "same_root_cause_confirmed": true,
      "distinct_variant": false,
      "reason": "Different placement demonstrates structural coverage but cannot bypass one match slot per malformed request."
    }
  ],
  "final_equivalence_assessment": "No distinct candidate both shared the parent root cause and remained triggerable on the fixed target.",
  "confidence": 0.98,
  "evidence": [
    "bundle/logs/vuln_variant/candidate_matrix.log",
    "bundle/logs/vuln_variant/static_coverage.log",
    "bundle/logs/vuln_variant/fix_diff.txt",
    "bundle/logs/vuln_variant/vulnerable_query_scalar.json",
    "bundle/logs/vuln_variant/fixed_query_scalar.json"
  ]
}