Polylang Copy Content WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB #10 in Languages & Localization

Medium-severity findings.

Audited release

1.0.0

Findings

2

Worst severity

medium

Content hash

561e7034710a83243243cdd2… Copy

Findings

• medium IDOR: translation copy loads any post into the editor without read/edit capability

  missing_capability

  copy_content_and_title() runs on rest_api_init (Gutenberg, via rest_get_server() during block_editor_rest_api_preload) and add_meta_boxes (classic editor) whenever pagenow is post-new.php and $_GET['from_post'] and $_GET['new_lang'] are present. WordPress core only checks create_posts/edit_posts for the NEW post type; the plugin never calls current_user_can('read_post') or current_user_can('edit_post') on the source ID. It int-casts from_post, get_post()s it, and assigns post_content/post_title onto the global $post auto-draft. Gutenberg then copies those fields into $initial_edits for auto-drafts (after preload already fired this hook); classic editor renders the same $post in the textarea. A Contributor can therefore open /wp-admin/post-new.php?from_post={private_or_other_users_draft_id}&new_lang=fr and read unpublished/private/password-protected content, including pages or other types, then save a copy as their own pending post. The success admin notice also prints the source post_title unescaped. Subscriber/customer cannot reach post-new.php. Not unauth.

  polylang-copy-content.php:40-84

  Recommendation

  Before copying, require current_user_can('read_post', $from_post_id) (and preferably current_user_can('edit_post', $from_post_id) so only users who could edit the source can spawn a translation). Bail if get_post() or get_language() is empty. Restrict from_post to the same post type. Escape the admin notice with esc_html().

• medium CSRF: GET post-new.php clones attachments and sets the featured image without a nonce

  csrf

  The same handler is a state-changing GET with no wp_verify_nonce. Auth cookies are SameSite=Lax, which still attach on top-level navigations, so a Contributor+ who follows a cross-site link to /wp-admin/post-new.php?from_post=ID&new_lang=SLUG causes: (1) WordPress to insert an auto-draft, (2) copy_featured_image() → set_post_thumbnail() writing _thumbnail_id immediately, (3) translate_attachment() → wp_insert_attachment() plus add_post_meta for _wp_attachment_metadata/_wp_attached_file/_wp_attachment_image_alt, PLL language, and save_translations — even when the victim lacks upload_files (default Contributor). copy_attached_media() runs WP_Query with 'parent' => $from_post_id, which is only an orderby alias in WP_Query, not a post_parent filter; with posts_per_page=-1 and Polylang lang= it can create a translated attachment row for every item in the source language on first use. Persistent effect is media-library pollution and an auto-draft with a thumbnail, not site takeover. No unauth path.

  polylang-copy-content.php:43-84,426-467,513-531

  Recommendation

  Do not insert attachments or set thumbnails on a mere GET of post-new.php. Require a Polylang-issued nonce (or POST) plus current_user_can('upload_files') before wp_insert_attachment. Change the WP_Query arg from parent to post_parent so only media attached to the source post is considered.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.