High-severity findings.

Audited release

0.13.4

Findings

3

Worst severity

high

Content hash

b88b2c20d90f0d4b6688a7f8… Copy

Findings

• high updateGfEntry broken authorization allows rewriting guest (and own) entries

  auth_bypass

  The mutation is denied only when the user lacks gravityforms_edit_entries AND the entry has a non-empty created_by AND the current user is not that user. PHP empty('0'), empty(0), empty(null) and empty('') are all true, and Gravity Forms stores anonymous created_by as NULL/0/'0'. Result: any unauthenticated caller who enumerates sequential entry database IDs can GFAPI::update_entry on every guest submission — field values (including administrative fields; no visibility check), status (active/spam/trash), isRead/isStarred, date_created, IP, source_url — and GFFormsModel::create_post() is invoked on every update. shouldValidate defaults to true in code but the client can send shouldValidate:false. Gravity Forms' own REST PUT /entries requires gravityforms_edit_entries. Subscribers can also rewrite their own entries, which GF does not allow from the front end. Reads of other users' entries remain gated by SubmittedEntry::is_private (strict ===), so this is write-IDOR, not list-IDOR.

  src/Mutation/UpdateEntry.php:106-112

  Recommendation

  Require gravityforms_edit_entries (or a documented, filterable cap) for updateGfEntry. Do not treat empty/zero created_by as authorization. If 'edit own entry' is intentional, require a logged-in user, compare with absint on both sides, and still forbid status/createdById/post updates and administrative field writes without the GF cap.

• high Unauthenticated GraphQL form queries leak notifications, quiz keys, and admin-only config

  information_disclosure

  Form::is_private() only hides forms with requireLogin from logged-out users. Every other form — including inactive and trashed ones queried via gfForms(where:{status:TRASHED}) or gfForm(id:) — returns the full admin object: notifications.to/bcc/from/replyTo/message/subject and routing.email (staff inboxes and internal templates), postCreation content/title templates and default post author, personalData retention/export policy, calculationFormula, HTML field content, and, when Gravity Forms Quiz is active, each choice's isCorrect/weight plus answerExplanation. None of that is required to render a headless form. There is no get_restricted_fields() and no capability check on FormNotification. Observable: a single unauthenticated GraphQL POST to /graphql with { gfForms { nodes { notifications { to bcc from message routing { email } } formFields { ... on QuizField { choices { isCorrect } } } } } } returns admin notification addresses and the quiz answer key.

  src/Model/Form.php:73-78

  Recommendation

  Restrict notifications, personalData, postCreation, calculationFormula, quiz isCorrect/weight/answerExplanation, and similarly admin-only fields to gravityforms_edit_forms (or view_settings). Filter administrative-visibility formFields out of public connections. Do not list INACTIVE/TRASHED forms without a GF capability. Keep title/description/visible fields/confirmations public for headless rendering.

• medium submitGfForm and updateGfDraftEntry let unauthenticated clients forge created_by and IP

  missing_capability

  SubmitForm::prepare_entry_data copies entryMeta.createdById, dateCreatedGmt, ip, sourceUrl, and userAgent into GFAPI::update_entry_property with no capability check. UpdateDraftEntry does the same for created_by (unlike updateGfEntry, which at least gates createdById behind gravityforms_edit_entries). An unauthenticated SubmitGfForm can attribute the entry to any wp_users.ID, spoof the IP (bypassing GF per-IP entry limits), and backdate date_created. Forged created_by also interacts with updateGfEntry: a subscriber who stamps createdById as themselves can later rewrite that entry as 'owner'. sourceUrl is not sanitized on submit.

  src/Mutation/SubmitForm.php:188-216

  Recommendation

  Ignore createdById unless the current user has gravityforms_edit_entries. Always set created_by from get_current_user_id() on public submits. Do not accept client IP/dateCreated unless that same cap is present; otherwise use GFFormsModel::get_ip() and current time. Sanitize sourceUrl with esc_url_raw.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.