{
  "schema_version": 1,
  "stage": "vuln_variant",
  "verdict": "no_distinct_variant_or_bypass",
  "confirmed": false,
  "bypass_confirmed": false,
  "alternate_trigger_confirmed": false,
  "parent_vulnerable_control_confirmed": true,
  "fixed_version_tested": true,
  "latest_default_branch_checked": true,
  "submitted_target": {
    "repository": "https://github.com/WordPress/wordpress-develop.git",
    "version": "7.0.1",
    "commit_sha": "18f793b1f16c1b15b0fc37027f4aeaefab0bfe02"
  },
  "fixed_target": {
    "version": "7.0.2",
    "commit_sha": "855551c4477bd5a0407221c57dae123c4163b434",
    "runtime_tested": true
  },
  "latest_target": {
    "ref": "refs/heads/trunk",
    "commit_sha": "ace9192af868524bdc49cf4fcb91f4c12c73ee5f",
    "runtime_tested": false,
    "source_checked": true,
    "notes": "Exact unreleased 7.1 development revision resolved from origin/trunk on 2026-07-18; all three guards retained."
  },
  "required_entrypoint_kind": "endpoint",
  "required_entrypoint_detail": "Unauthenticated POST /wp-json/batch/v1",
  "candidate_results": [
    {
      "candidate_id": "body_scalar_alternate_data_path",
      "material_difference": "author_exclude supplied in shifted subrequest JSON body rather than URL query",
      "vulnerable_target_triggered": false,
      "fixed_target_triggered": false,
      "result": "ruled_out_not_a_trigger"
    },
    {
      "candidate_id": "query_scalar_parent_primitive_control",
      "material_difference": "parent sink control used to validate runtime matrix",
      "vulnerable_target_triggered": true,
      "fixed_target_triggered": false,
      "result": "fixed_blocks_parent_primitive"
    },
    {
      "candidate_id": "alternate_malformed_batch_placement",
      "material_difference": "malformed entry followed by different post/user route sequence to compare index alignment",
      "vulnerable_target_triggered": true,
      "fixed_target_triggered": false,
      "result": "fixed_alignment_invariant_confirmed"
    }
  ],
  "observed_impact_class": "no_fixed_version_impact",
  "end_to_end_target_reached": false,
  "exploit_chain_demonstrated": false,
  "blocking_mitigation": "WordPress 7.0.2 independently aligns batch arrays, normalizes all author__not_in shapes at the WP_Query sink, and blocks nested top-level REST dispatch at both rest_api_loaded() and serve_request().",
  "claim_block_reason": "No distinct input or entry path bypassed the fixed target; the only live SQL marker was the parent query-scalar primitive on 7.0.1.",
  "impact_parity": "none",
  "idempotency": {
    "verified": true,
    "run_count": 2,
    "run_exit_codes": [1, 1],
    "expected_negative_exit_code": 1
  },
  "evidence": [
    "bundle/logs/vuln_variant/verification_run1.log",
    "bundle/logs/vuln_variant/verification_run2.log",
    "bundle/logs/vuln_variant/two_run_verification.log",
    "bundle/logs/vuln_variant/candidate_matrix.log",
    "bundle/logs/vuln_variant/vulnerable_query_scalar.json",
    "bundle/logs/vuln_variant/fixed_query_scalar.json",
    "bundle/logs/vuln_variant/vulnerable_body_scalar.json",
    "bundle/logs/vuln_variant/fixed_body_scalar.json",
    "bundle/logs/vuln_variant/vulnerable_batch_alignment.json",
    "bundle/logs/vuln_variant/fixed_batch_alignment.json",
    "bundle/logs/vuln_variant/static_coverage.log",
    "bundle/logs/vuln_variant/source_identity.log"
  ]
}