Building on what @lucas-bustamante wrote (which helped me a ton!), once you have the X-WP-Nonce header setup in your custom routes you can do the following:
register_rest_route('v1', '/my_post', [
'methods' => WP_REST_Server::CREATABLE,
'callback' => [$this, 'create_post'],
'args' => [
'post_title' => [
It looks like one of your plugins/themes is vulnerable and allows anyone to modify your database. For example ThemeGrill themes have such vulnerability lately.
Another possibility is that your site got hacked and there's some backdoor placed on it.
In both cases you should:
check all your site
I've run your code and it works fine to me except for the inclusion in file-access.php:
enable debug to see if there are errors depending on other issues and not regarding these specific code lines.
But.. as per WP documentation: actions reference the earlier action hook where the authentication ...
Worth having a read of the trac bug here: https://core.trac.wordpress.org/ticket/18322
In short, you can use stripslashes as onetrickpony already mentioned, or wp_unslash, to remove the slashes from your $_POST vars.
With the user-name-based nonces, i think you are trying to protect yourself from CSRF attacks, this should work to some extent (hard to tell without the full source code), that being said the nonces should be assigned to a specific action (not only an action), so, for example, you do not assign it to a "delete item" action but rather to "delete item with ID=...