High-severity findings.

Audited release

1.6.57

Findings

6

Worst severity

high

Content hash

b88e67ee7a86933c14d89572… Copy

Findings

• high Unauthenticated AJAX can delete arbitrary object metadata

  missing_auth

  wp_ajax_nopriv_boros_drop_upload_remove calls delete_metadata() using attacker-controlled object_type, post_id, and meta_key with no nonce and no capability check. An unauthenticated visitor can clear thumbnails or other meta on posts/users/terms.

  functions/media_uploader.php:192-201

  Recommendation

  Remove nopriv registration; require a capability (e.g. edit_post) and check_ajax_referer before delete_metadata.

• high Unauthenticated image upload and metadata write via drop uploader

  missing_capability

  wp_ajax_nopriv_boros_drop_upload_add accepts uploads for any logged-out visitor when a nonce for action `{imgid}pluploadan` is known (nonce is created wherever the drop UI is rendered). It saves an attachment and update_metadata() for attacker-chosen post_parent/meta_key. Only getimagesize validation is applied; no capability check.

  functions/media_uploader.php:103-178

  Recommendation

  Drop nopriv; require edit capability on the target object; bind nonce to a fixed action plus object id.

• high Event attendee manage AJAX lacks nonce and capability checks

  missing_auth

  wp_ajax handlers bev_user_approve, bev_user_queue, bev_user_remove, and bev_user_cancel perform state-changing attendee list updates with no check_ajax_referer and no current_user_can. Any authenticated Subscriber can approve/reject/cancel registrants for any event id.

  functions/events.php:1231-1298

  Recommendation

  Require manage_options or edit_post on the event, plus a verifying nonce, before mutating attendee queues.

• high Attendee roster export AJAX discloses PII without authorization

  information_disclosure

  bev_download_users_xls/html are registered as wp_ajax_* only (any logged-in user) and stream XLS/HTML of event queues including user data with no capability or nonce check.

  functions/events.php:1860-1890

  Recommendation

  Gate exports behind edit_post/manage_options and check_ajax_referer; do not expose via GET without auth.

• high User info lightbox AJAX leaks email/phone/DOB without auth

  information_disclosure

  bev_user_info_lightbox loads another user's email, phone, birth date, confirmation code, and event answers for arbitrary user_id/bev_id with no capability or nonce check (any logged-in role).

  functions/events.php:662-720

  Recommendation

  Require capability to manage the event and a nonce; never return other users' PII to Subscribers.

• high Erase extra user info AJAX without authorization

  missing_auth

  bev_erase_extra_user_info deletes user meta for all event participants and updates post meta with no nonce or capability check.

  functions/events.php:1451-1464

  Recommendation

  Require manage_options/edit_post and a nonce before bulk-deleting user meta.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.