Newspack Content Converter WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.2.0

Findings

1

Worst severity

medium

Content hash

4b1cec16cfeed866a3aacd4c… Copy

Findings

• medium Converter REST endpoints read/overwrite any post's content without per-object capability checks

  missing_capability

  All converter routes rely on rest_permission(), which only checks current_user_can('edit_others_posts'). update_post_content() passes a client-supplied post_id straight to ConversionProcessor::update_converted_post(), which overwrites post_content with client-supplied content_blocks via wp_update_post() for ANY post ID and post type, and get_post_content() returns raw post_content for any ID. An Editor (or any role holding edit_others_posts) can therefore rewrite content of post types core would not let them edit (e.g. wp_template, wp_template_part, wp_global_styles, which require edit_theme_options) and read content of posts they cannot read. restore-post-contents with an empty id list also reverts every converted post site-wide.

  lib/class-convertercontroller.php:186-191, 381-410

  Recommendation

  Check current_user_can( 'edit_post', $post_id ) (and read_post for get-post-content) for every ID, restrict to the post types the converter targets, and consider requiring manage_options for the batch/restore endpoints.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.