Tonys SportsPress Enhancements WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.1.23

Findings

2

Worst severity

high

Content hash

207c264eadf4c8224c78d3c7… Copy

Findings

• high Officials Manager assignment-only lock does not apply to REST event updates

  auth_bypass

  The plugin creates role sp_officials_manager with edit_sp_event / edit_sp_events / edit_others_sp_events / edit_published_sp_events (plus primitive edit_posts / delete_posts) while documenting assignment-only access: the full event editor is redirected away and wp_insert_post_data is supposed to freeze title, content, date, slug, status, and author. That freeze returns immediately unless is_admin() is true, so WordPress REST requests (is_admin() false) apply the user's real caps. SportsPress registers sp_event with show_in_rest and rest_base events, and several event REST fields use update_callback SP_REST_API::update_post_meta. An Officials Manager logged into wp-admin (event list / Quick Edit) can send an authenticated PATCH to the events REST route and change published title, content, date, teams, results, format, and day. The editor lock only inspects $_GET['post'] on post.php, so it also misses POST-only saves. Hierarchical taxonomies (league, season, venue) remain in Quick Edit and are not restored by the post-data filter. Subscriber is unaffected; this is the plugin's own restricted staff role.

  includes/sp-officials-manager-role.php:384-420

  Recommendation

  Apply the field freeze whenever tony_sportspress_is_officials_manager_user() is true, including REST and xmlrpc (drop the is_admin() gate). Block REST updates of sp_event for that role except sp_officials. Restore or unset league/season/venue on Quick Edit. Narrow the role to the officials CPT caps plus edit_sp_event for Quick Edit; do not grant edit_others_sp_events / edit_published_sp_events / edit_posts unless those writes are actually intended.

• medium Unauthenticated matchup image endpoint ignores post status and the rewrite flag

  information_disclosure

  handle_image_request() runs on template_redirect for every frontend request that has $_GET['post'], without checking the head-to-head rewrite query var or is_post_publicly_viewable(). asc_sp_event_prepare_image_request() only requires post_type === sp_event and two team IDs, then get_post() / get_the_title() / logos are used for drafts, private, pending, and password-protected events. An unauthenticated client can enumerate sequential IDs (GET /?post=ID or /head-to-head?post=ID&variant=wide) and receive a PNG of unpublished matchups (team names, colors, logos). Non-event IDs 404-exit the original page, so any public URL that already uses ?post= is also taken over. Contrast: MCP abilities in the same plugin explicitly refuse non-publish/future statuses.

  includes/featured-image-generator.php:774-808

  Recommendation

  Return unless the head-to-head query var is set. Refuse events that are not publicly viewable (publish/future, or password only after the password). Do not exit/404 unrelated requests that merely include ?post=.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.