To review the initial code push

*This is a blocker.* You're taking an arbitrary array of `$_POST` arguments and passing them to `WP_Query`. This means that a savvy enough user can perform any query they want on the posts table (be it a super complex one to take down the site, or a malicious one to try to obtain data from private or unpublished posts, or depending on third-party plugins, something else like ecommerce transaction details or coupon codes).