WPScan rejects the entire MITM class, whatever the impact

My AI Engine report was rejected, and the reason had nothing to do with the quality of the report. The same message praised the accuracy, the evidence, and the controls I had identified between 3.6.3 and 3.6.4.

The rejection was on the class. Requiring the attacker to hold a position on the network path between the site and the provider is, for WPScan, a precondition that sits outside scope. The outcome does not change that: key disclosure, response tampering, and code execution are all treated the same way once the precondition is network position.

The practical conclusion is worth stating plainly. Do not submit CWE-295, sslverify => false, or any unverified-certificate finding to WPScan or Patchstack expecting an identifier. The value in that class is the vendor fix and the public credit, not a CVE number.

There is a second, more useful conclusion. A rejection on scope is not a duplicate. The finding remains available to another channel, which is not true when the answer is 'already known'. That single distinction decides whether the work is finished or simply needs a different door.