# Batch Endpoint Validate-Execute Desync Is an Exploitable Seam ## Claim A batch API handler that validates each sub-request in one loop and executes it in a separate loop can let one route's parameter sanitization silently apply to a different route's execution, so the seam between the two loops is itself the attack surface — not any single missing check. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds when a batch/bulk endpoint processes N sub-requests by first building a validation array, then separately iterating an execution array, and any control-flow statement (like `continue`) can advance one array's index without advancing the other's. - Breaks down for batch handlers that validate and execute each sub-request atomically in the same loop iteration — there's no window for the arrays to fall out of sync. - Doesn't require any single endpoint to have a coding bug in isolation; the vulnerability is the composition of the two loops, not either loop alone. ## Evidence The WordPress REST Batch API (introduced WP 5.6) updates a `$validation` array in one loop but, because of a `continue;`, doesn't update the matching execution `$matches` array in step. That desync let a batch request apply one endpoint's (weaker) validation to a different endpoint's execution path, surfacing a previously unknown pre-auth SQL injection that a multi-agent AI research run then escalated to full admin takeover and RCE. > [!quote] > "the $validation array is updated, but because of the continue;, the matches array isn't updated!" ## Links - [[WordPress Hosting Security Stack MOC]] — a specific and repeatable API flaw worth checking for in any batch handler - [[3. Resources/Permanent Notes/Validation That Inspects Steps Cannot See Composition]] — because extends; both describe validation logic that's structurally blind to how its own steps compose, one at the request-sequence level and this one at the two-array level within a single batch request - [[3. Resources/Permanent Notes/Sanitizer Changes Carry Site-Wide Blast Radius]] — because applies-in; a sanitizer swapped across routes via this desync is a live instance of validation logic having reach beyond its intended endpoint - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — because evidence-for; this specific technical mechanism is the chain that source's multi-agent research surfaced ## Tests / falsifiers - Audit any in-house REST/GraphQL batch or bulk endpoint for a validate-array/execute-array split fed by the same control-flow structure; a match confirms the pattern generalizes past this one WordPress bug. - If a batch handler can be shown to validate and execute atomically per sub-request (no separate arrays, no intervening `continue`), this specific seam doesn't exist there even if other vulnerabilities do. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25]] — Adam Kues's full technical writeup of the batch-desync SQLi, the scalar-sanitization bypass, and the cache-poisoning escalation.