Several public REST routes declare email arguments as strings but replace the default schema validator with the raw is_email callback. Non-string request values can therefore reach a scalar-only callback instead of returning a normal rest_invalid_param response. Use the REST schema's native type: string and format: email validation on registration, contact submission, and image voting, with regression coverage for non-string values.\n\nDiscovered by the disposable WordPress 7.0.2 adversarial authentication campaign.
Several public REST routes declare email arguments as strings but replace the default schema validator with the raw is_email callback. Non-string request values can therefore reach a scalar-only callback instead of returning a normal rest_invalid_param response. Use the REST schema's native type: string and format: email validation on registration, contact submission, and image voting, with regression coverage for non-string values.\n\nDiscovered by the disposable WordPress 7.0.2 adversarial authentication campaign.