| @@ -94,9 +94,13 @@ | ||
| 94 | 94 | case 'PATCH': |
| 95 | 95 | case 'DELETE': |
| 96 | 96 | return current_user_can('yatra_edit_trips'); |
| 97 | 97 | default: |
| 98 | - return current_user_can('manage_options'); | |
| 98 | + // Unknown HTTP method — deny explicitly. The earlier | |
| 99 | + // fallback to `manage_options` was a regression that | |
| 100 | + // silently broadened admin-only access for any verb not | |
| 101 | + // in the explicit switch. | |
| 102 | + return false; | |
| 99 | 103 | } |
| 100 | 104 | } |
| 101 | 105 | |
| 102 | 106 | public function get_items(WP_REST_Request $request) |
