<?php
/*
Plugin Name: Inception REST Batch Hardening
Description: Blocks unauthenticated access to the WordPress REST batch endpoint (CVE-2026-63030) and sanitises author__not_in (CVE-2026-60137). Deployed 2026-07-28 after the batch endpoint was confirmed as the fleet compromise vector.
Version: 1.1.0
Author: Inception Ops
*/

// CVE-2026-63030 — REST API batch route confusion.
// NOTE: the real route is "/batch/v1". An earlier in-house mitigation matched
// "/v2/batch", which never fires — sites carrying it were still compromised.
add_filter( 'rest_pre_dispatch', function ( $result, $server, $request ) {
	if ( null !== $result ) {
		return $result;
	}
	$route = (string) $request->get_route();
	if ( preg_match( '#^/?batch/v\d#i', $route ) && ! current_user_can( 'edit_posts' ) ) {
		return new WP_Error(
			'rest_batch_forbidden',
			'Batch endpoint requires an authenticated editor or above.',
			array( 'status' => 403 )
		);
	}
	return $result;
}, 1, 3 );

// CVE-2026-60137 — author__not_in SQL injection: force integers.
add_action( 'pre_get_posts', function ( $query ) {
	if ( ! empty( $query->query_vars['author__not_in'] ) ) {
		$query->query_vars['author__not_in'] = array_map(
			'absint',
			(array) $query->query_vars['author__not_in']
		);
	}
} );
