REST arrays have no item-count cap and JSON bypasses input-variable limits

Summary

REST collection array parameters accept unbounded item counts. JSON bodies and method override can bypass practical URL/input-variable limits, increasing query and validation work.

Affected Products

WordPress core 7.0.4; REST collection parameter validation.

Affected Scope

Product

WordPress

Component

REST collection parameters and validation

Affected function

WP_REST_*_Controller; include[]; slug[]; exclude[]; parent[]; JSON body; X-HTTP-Method-Override

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-400; CWE-770

Technical Summary

The REST schema does not impose a consistent item-count cap on collection arrays, and alternate request encodings bypass common transport limits.

Prerequisites and Permissions

Unauthenticated access to a public REST collection accepting the affected array parameters.

Affected Locations

wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php and related collection controllers; array parameters and request parsing.

Reproducible Proof

Controlled requests with increasing array cardinality produced increasing validation/query work without a server-side item-count rejection. Exact stress sizes withheld.

Vulnerable Code

$parameter_mappings = array(
    &class="tok-comment">#39;excludeclass="tok-string">' => 'post__not_in',
    &class="tok-comment">#39;includeclass="tok-string">' => 'post__in',
    &class="tok-comment">#39;parentclass="tok-string">' => 'post_parent__in',
    &class="tok-comment">#39;slugclass="tok-string">' => 'post_name__in',
);
foreach ( $parameter_mappings as $api_param => $wp_param ) {
    if ( isset( $registered[ $api_param ], $request[ $api_param ] ) ) {
        $args[ $wp_param ] = $request[ $api_param ];
    }
}

Severity

low

Technical Analysis

Collection controllers accept arrays such as include, slug, exclude and parent without a uniform maxItems bound. JSON requests can carry many items without PHP max_input_vars or URI-length constraints, allowing large query construction and repeated validation.

Impact

Availability impact: an unauthenticated client can amplify parsing, validation and database work on public REST collections. No protected-data disclosure is claimed.

Remediation

Declare maxItems/maxLength for array parameters, bound JSON body size and per-request item cost, and add route-level query budgets/rate limits.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.