Decker WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

2.1.17

Findings

4

Worst severity

high

Content hash

4cff4372784d9d69b362c28c… Copy

Findings

• high Calendar REST grants access to any logged-in user with read capability

  missing_capability

  get_calendar_permissions_check() returns true if (1) any valid X-WP-Nonce for wp_rest verifies, or (2) the caller is logged in with current_user_can('read'). Subscribers have 'read', so they can enumerate Decker calendar/event JSON without meeting Decker::current_user_has_at_least_minimum_role() (default editor). The frontend template_redirect enforces the minimum role, but this REST path does not. Observable: GET /wp-json/decker/v1/calendar returns internal event data.

  includes/class-decker-calendar.php:115-145

  Recommendation

  Require Decker::current_user_has_at_least_minimum_role() (or a dedicated capability) after nonce verification; do not treat subscriber `read` as sufficient. Token-based calendar feeds should remain on the dedicated token path only.

• high Calendar REST grants access to Subscribers and any valid wp_rest nonce

  missing_capability

  get_calendar_permissions_check() returns true if (1) X-WP-Nonce verifies for action wp_rest (no is_user_logged_in / minimum_role check), or (2) the caller is logged in with current_user_can('read'). Subscribers have 'read', so they can enumerate GET decker/v1/calendar and typed feeds. Response includes task titles, descriptions, due dates, and assigned user IDs via get_task_calendar_events(). Decker front templates enforce Decker::current_user_has_at_least_minimum_role (default editor), but this REST path bypasses that gate.

  includes/class-decker-calendar.php:116-148

  Recommendation

  Align calendar permission_callback with Decker::current_user_has_at_least_minimum_role(); never treat a bare wp_rest nonce as sufficient without verifying the user meets the minimum role (token-based feed access can remain separate).

• high nopriv task save AJAX has nonce but no capability check

  missing_capability

  wp_ajax_nopriv_save_decker_task is registered alongside the authed action. handle_save_decker_task only calls check_ajax_referer('save_decker_task_nonce') then Decker_Task_Writer::create_or_update_task with no current_user_can / minimum_role check. save_decker_task_nonce is localized into deckerData on Decker pages (for users who pass template_redirect minimum_role). Prefer escalate: unauthenticated registration plus writer without caps means any leaked/forged uid-0 or low-priv nonce can create or update tasks.

  includes/custom-post-types/class-decker-task-ajax-save.php:46-115

  Recommendation

  Remove wp_ajax_nopriv_save_decker_task; require is_user_logged_in() and Decker::current_user_has_at_least_minimum_role() (and edit_post for updates) after the nonce check.

• medium Task save AJAX registered for nopriv without capability check

  missing_capability

  wp_ajax_nopriv_save_decker_task is registered and handle_save_decker_task only calls check_ajax_referer('save_decker_task_nonce'); Decker_Task_Writer::create_or_update_task performs no current_user_can / minimum-role check. Frontend pages that mint the nonce require login+minimum role, so unauthenticated exploitation needs a leaked nonce, but the nopriv hook plus missing capability gate is a defense-in-depth failure and would allow any role that obtains the nonce to create/update tasks.

  includes/custom-post-types/class-decker-task-ajax-save.php:46-72

  Recommendation

  Remove the nopriv action. After nonce verification require Decker::current_user_has_at_least_minimum_role() (and edit capability for updates) before calling Decker_Task_Writer.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.