A WordPress plugin did not merely miss one permission check. Its request path could send the method allowlist, nonce check, login requirement and capability gate through an error handler that logged the failure and returned control to the caller. The…