| @@ -81,9 +81,13 @@ | ||
| 81 | 81 | case 'PATCH': |
| 82 | 82 | case 'DELETE': |
| 83 | 83 | return current_user_can('yatra_edit_trips'); |
| 84 | 84 | default: |
| 85 | - return current_user_can('manage_options'); | |
| 85 | + // Unknown HTTP method — deny explicitly. The earlier | |
| 86 | + // fallback to `manage_options` was a regression that | |
| 87 | + // silently broadened admin-only access for any verb not | |
| 88 | + // in the explicit switch. | |
| 89 | + return false; | |
| 86 | 90 | } |
| 87 | 91 | } |
| 88 | 92 | |
| 89 | 93 | public function get_items(WP_REST_Request $request) |
