fix(wpmc S5): wrap Redirect get_permalink + safe rest_url replacement

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/RestUrlFilterTest.php

@@ -34,4 +34,16 @@ final class RestUrlFilterTest extends TestCase
         $url = 'https://other.example/wp-json/wp/v2/posts';
         self::assertSame($url, RestUrlFilter::preserve_host($url));
     }
+
+    public function test_preserve_host_does_not_interpret_replacement_metachars_in_host(): void
+    {
+        // $_SERVER['HTTP_HOST'] is attacker-controlled (Host header).
+        // The replacement string must not interpret $0/\\1 as backreferences.
+        $_SERVER['HTTP_HOST'] = 'evil$0.com';
+
+        self::assertSame(
+            'https://evil$0.com/wp-json/wp/v2/posts',
+            RestUrlFilter::preserve_host('http://example.org/wp-json/wp/v2/posts')
+        );
+    }
 }