Unbabble WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

0.7.0

Findings

3

Worst severity

high

Content hash

40bc715564c8be2240d90864… Copy

Findings

• high Authenticated administrator SQL injection in HiddenContent REST endpoints

  sql_injection

  GET /wp-json/unbabble/v1/default_on_hidden/posts and .../terms are state-changing REST routes gated only by manage_options. The post-types and taxonomies query params are whitelist-filtered only when they are strings. When passed as arrays (post-types[]=...), the values are implode()'d and interpolated into SELECT ... post_type IN ('{$post_types}') / taxonomy IN ('{$taxonomies}') with no $wpdb->prepare or esc_sql. Allowed locale codes are likewise implode-interpolated into locale IN ('{$allowed_languages}'). WP REST unslashes query params, so magic quotes do not apply. An administrator (or stolen admin application password) can time-based dump or modify the database; the same handler then bulk-calls LangInterface::set_post_language / set_term_language on the result set.

  lib/API/Actions/HiddenContent.php:52-198

  Recommendation

  Require POST, add a JSON schema with sanitize_callback, and build the query exclusively with $wpdb->prepare plus a strict in_array whitelist applied to arrays as well as strings. Escape or parameterize locale lists (e.g. array_map('esc_sql', get_languages()) or a %s placeholder per locale). Validate language codes to a locale pattern before they are stored in ubb_options.

• medium Translation-link REST and save_post write ubb_source on posts the user cannot edit

  missing_capability

  All Gutenberg post routes share one permission_callback that only checks current_user_can(edit_post, $request['id']). PATCH /unbabble/v1/edit/post/{id}/translation/{translation_id}/link then calls LinkTranslation::link_translations($post_id, $translation_id) with no cap check on translation_id. If the target has no ubb_source, set_post_source(..., true) writes that meta on the victim post. The same missing object-level check exists on save_post via $_POST['ubb_link_translation'] (classic/Gutenberg form save). A Contributor/Author who can edit one translatable post can attach it to any other post of that type, pollute another author's translation group, and later unlink a two-member group which also deletes the remaining post's source. Frontend LangInterface::translate_current_url will then treat the victim as a language alternate.

  lib/API/Gutenberg/Post.php:93-212

  Recommendation

  In permission_callback (or inside link_translations) also require current_user_can(edit_post, $translation_id) and refuse to force-write ubb_source on a post the user cannot edit. Apply the same check in Posts\LinkTranslation::save_link_translations.

• medium Authors can enumerate other users' draft, private, and trash post titles via translation-link search

  information_disclosure

  GET /unbabble/v1/edit/post/{id}/translation/link is allowed for anyone who can edit {id}. get_possible_links runs an unscoped SQL query for every post of that type with post_status NOT IN ('revision','auto-draft') and returns titles, IDs, and locales grouped by ubb_source. WordPress Authors/Contributors cannot list other users' drafts in wp-admin, but this endpoint returns them (including private and trash). Separately, Admin::enqueue_scripts copies get_post($_GET['ubb_source'])->post_title into the UBB localized script on post-new.php with no capability check, so ?ubb_source={id} leaks another post's title to any user who can load the editor.

  lib/Posts/LinkTranslation.php:148-220

  Recommendation

  Restrict candidate posts with the same caps WP_Query uses for the user (author=current user unless they have edit_others_posts; exclude private unless read_private_posts). Strip other authors' non-public titles from the REST payload. In Admin::enqueue_scripts, only expose source_title after current_user_can('edit_post', $source_id) or 'read_post'.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.