Schoolbooth Photo Manager WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

3.4.1

Findings

2

Worst severity

high

Content hash

d4e53666fe311aa5442517ee… Copy

Findings

• high Minors' photos, access-code map and consent log stored in public uploads with Apache-only (and image-permissive) protection

  information_disclosure

  Photos are written to wp-content/uploads/<upload_path>/photos/, the code-to-file map to uploads/<upload_path>/access_codes.json, and the audit fallback log (consent emails) to uploads/schoolbooth/data/audit-fallback.log. The only protection is an .htaccess written on activation. It does nothing on nginx, IIS or LiteSpeed without htaccess, and nothing if the admin changes upload_path, because no .htaccess is written to the new path. On those hosts an unauthenticated GET of access_codes.json reveals every photo path and access code. Even on Apache, the .htaccess explicitly 'Allow from all' for jpg/jpeg/png/gif, and get_photos_data() emits direct baseurl URLs for images and thumbnails. Anyone with or guessing a photo path can fetch it directly, bypassing the HMAC link, expiry_days and download_limit. Photos are only deleted when the download limit is reached through the PHP handler, never on expiry.

  schoolbooth-photo-manager.php:53-78

  Recommendation

  Store photos, the code map and logs outside the web root (or in a randomized, non-guessable directory with server-agnostic deny rules). Never emit direct file URLs; stream every image through the HMAC/expiry/limit-checked handler. Move access-code records into the database, and delete expired files with a cron job.

• medium Portal access gate: consent check trusts any cookie and access-code guessing is not rate-limited

  auth_bypass

  SCHOOLBOOTH_Permissions_Form_Handler::has_completed_form() returns true when a cookie named schoolbooth_form_<code> merely exists, and never verifies the wp_hash token set on submission. The [schoolbooth_download_portal] shortcode calls get_photos_data($code) for any ?code= value with no call to the rate limiter; the limiter is only used by the HMAC download handler. An unauthenticated attacker can set the cookie and enumerate access codes against the portal page at full speed. Every hit returns that family's photo URLs and signed download links and skips the required release form. Real-world impact depends on the access-code entropy generated by the kiosk app.

  includes/class-permissions-form-handler.php:451-454

  Recommendation

  Validate the cookie value: store the issued token server-side, or make it an HMAC over the code and expiry that is verified with hash_equals. Apply SCHOOLBOOTH_Rate_Limiter (per IP and globally per code) to portal code lookups, and enforce a minimum access-code length and entropy at ingest.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.