{
  "variant_id": "CVE-2026-63030-negative-fixed-coverage-20260718",
  "created_at": "2026-07-18T13:45:00Z",
  "variant_summary": "No distinct variant or WordPress 7.0.2 bypass was confirmed. A body-scalar alternate path failed on both targets; the query-scalar primitive reflected a synthetic row only on WordPress 7.0.1; malformed-batch alignment and exact trunk source checks show all three independent fixes remain effective.",
  "relation": "newer_version_sibling",
  "origin_kind": "pruva_variant",
  "repository": "https://github.com/WordPress/wordpress-develop.git",
  "submitted_target": {
    "target_kind": "release_commit",
    "commit_sha": "18f793b1f16c1b15b0fc37027f4aeaefab0bfe02",
    "version": "7.0.1",
    "ref": "7.0.1",
    "display": "WordPress 7.0.1 vulnerable parent target"
  },
  "variant_target": {
    "target_kind": "fixed_release_commit",
    "commit_sha": "855551c4477bd5a0407221c57dae123c4163b434",
    "version": "7.0.2",
    "ref": "7.0.2",
    "display": "WordPress 7.0.2 fixed runtime target; latest trunk ace9192af868524bdc49cf4fcb91f4c12c73ee5f source-checked"
  },
  "same_root_cause_confidence": 0.98,
  "same_surface_confidence": 0.99,
  "claimed_surface": "Unauthenticated POST /wp-json/batch/v1 reaching shifted REST handlers, WP_Query author__not_in SQL construction, and nested top-level REST dispatch",
  "validated_surface": "Fresh unauthenticated REST batch probes against clean WordPress 7.0.1 and exact 7.0.2; exact trunk source coverage check",
  "required_entrypoint_kind": "endpoint",
  "required_entrypoint_detail": "POST /wp-json/batch/v1 with nested malformed batch subrequests",
  "attacker_controlled_input": "Malformed batch path and scalar author_exclude supplied in either URL query or JSON body",
  "trigger_path": "POST /wp-json/batch/v1 -> WP_REST_Server::serve_batch_request_v1 -> candidate shifted posts handler -> WP_Query::get_posts; fixed path stops at aligned handler and integer normalization",
  "observed_impact_class": "no_fixed_version_impact",
  "exploitability_confidence": 0.99,
  "evidence_scope": "production_path_negative_control",
  "runtime_manifest_present": true,
  "end_to_end_target_reached": false,
  "inferred": false,
  "claim_block_reason": "No materially distinct trigger reached the vulnerable sink on WordPress 7.0.2. The alternate body placement was not a trigger even on 7.0.1, while the live query-scalar control was blocked on 7.0.2.",
  "blocking_mitigation": "Independent batch-array alignment, sink-level wp_parse_id_list normalization, and caller/callee nested-dispatch guards; all retained on tested trunk revision.",
  "file_path": "src/wp-includes/rest-api/class-wp-rest-server.php",
  "line_start": 1715,
  "line_end": 1866,
  "secondary_anchors": [
    {
      "file_path": "src/wp-includes/class-wp-query.php",
      "line_start": 2399,
      "line_end": 2416
    },
    {
      "file_path": "src/wp-includes/rest-api.php",
      "line_start": 438,
      "line_end": 488
    },
    {
      "file_path": "src/wp-includes/rest-api/class-wp-rest-server.php",
      "line_start": 285,
      "line_end": 291
    }
  ],
  "review_scope_paths": [
    "src/wp-includes/rest-api/class-wp-rest-server.php",
    "src/wp-includes/rest-api.php",
    "src/wp-includes/class-wp-query.php",
    "src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php",
    "src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php",
    "src/wp-includes/class-wp-customize-manager.php",
    "src/wp-includes/theme.php",
    "SECURITY.md"
  ],
  "artifact_refs": {
    "variant_manifest": "bundle/vuln_variant/variant_manifest.json",
    "validation_verdict": "bundle/vuln_variant/validation_verdict.json",
    "runtime_manifest": "bundle/vuln_variant/runtime_manifest.json",
    "repro_log": "bundle/logs/vuln_variant/verification_run2.log",
    "root_cause_equivalence": "bundle/vuln_variant/root_cause_equivalence.json",
    "reproducer": [
      "bundle/vuln_variant/reproduction_steps.sh",
      "bundle/vuln_variant/variant_probe.py",
      "bundle/artifacts/wordpress-7.0.2-src.tar.gz"
    ]
  }
}