WordPress REST API SQL injection