{
  "are_the_other_fifteen_noise": {
    "answer": "No. The file is systemically unprepared.",
    "counted": {
      "engine_entailed": 16,
      "unprepared_with_a_variable": 26,
      "using_prepare": 0,
      "wpdb_query_calls": 26
    },
    "reading": "Every sampled finding is a genuine unprepared query. The engine reports 16 of 26 such sites, so it UNDER-reports rather than over-reports here. CVE-2023-23488 is simply the instance that got an identifier, because it is reachable unauthenticated; the rest are the same defect with different reachability.",
    "sampled": {
      "1073": "get_row(\"... WHERE ID = '\" . $this->user_id . \"'\")",
      "1512": "get_var(\"... WHERE code = '$code' LIMIT 1\")",
      "671": "get_row(\"... WHERE id = '$id' LIMIT 1\")",
      "705": "get_var(\"... WHERE ID = '\" . $this->user_id . \"'\")"
    }
  },
  "generated": "2026-09-09",
  "on_cutting_the_input_with_a_model": "Proposed by the maintainer when size looked like the blocker. The evidence argues for scoping rather than triage: two of 637 files found the CVE in 122 seconds, and task 2.10 already scopes by what a project declares it ships while diff-scoping is this spec's actual thesis. A model deciding what to cut adds a FIFTH quiet-failure surface -- if it drops the file holding the bug, the scan reports clean and nothing records why, which is the exact shape of all four failures found today. The reverse direction is where a model fits: not choosing what to remove, but ranking which regions get the budget first.",
  "reading": "CVE-2023-23488 is detected at classes/class.memberorder.php:936:getMemberOrderByCode -- the exact line verified in the source, in unmodified plugin code. The engine works; what has been unfit is the plumbing around it, which produced four separate quiet failures on this one checkout before a CPG it could load reached the arbiter.",
  "scan": {
    "build_seconds": 9.0,
    "cve_found": "model_entailed injection class.memberorder.php:936:getMemberOrderByCode",
    "entailed": 16,
    "input": "two files carrying both ends of the CVE: classes/class.memberorder.php and includes/rest-api.php, 2885 lines",
    "query_seconds": 110.9,
    "regions": 57,
    "total_seconds": 122.0
  },
  "spec": "contributor-scan 5.10 -- the first real CVE found in production code",
  "what_it_does_not_settle": [
    "The full 637-file checkout still does not load, and that boundary is unmeasured.",
    "Whether php2cpg resolves `new X()` and `$this->method()` is still unknown -- this slice found the sink through a same-function flow, not through the REST handler two calls away.",
    "One CVE on one plugin. The class-by-class table over several plugins (5.8) is still the artifact worth teaching from."
  ],
  "what_this_settles": "The question was whether the system can find one real CVE. It can, in production code, at the exact line, in two minutes, for a cent. What it could not do was survive its own plumbing at 637 files."
}