BM Concierge WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.1

Findings

2

Worst severity

high

Content hash

b88a8bbc2cab893fc7a2e571… Copy

Findings

• high Any logged-in user can overwrite arbitrary posts via the machine-translation order endpoint

  missing_capability

  Every Concierge REST route, including POST /bm-concierge/v1/order, uses permission_callback Concierge::has_logged_in_access which is only is_user_logged_in(). There is no current_user_can('edit_post') / edit_posts check anywhere on the write path. A Subscriber (or any other logged-in role) who can obtain a wp_rest nonce — wp-admin profile.php, heartbeat, or an application password — can POST JSON {type:'machine_translation', postId:<id>, targetLanguage:'DE', express:false, price:'0'}. process_order() instantiates MachineTranslation and calls order(). That method first sends the vendor/user emails, then get_translated_data() reads get_post($postId) with no capability check, translates title and HTML content with the site's BM_CONCIERGE_ML_TRANSLATION_API_KEY (DeepL tag_handling=html), and save_to_post() calls wp_update_post() on that ID. wp_update_post does not check capabilities, so this rewrites any post/page/CPT the ID refers to, including content the Subscriber cannot edit or even read (drafts). GET /services reports whether the DeepL constant is defined, so the attacker knows when the overwrite path is live. Without the key, save_to_post still runs wp_update_post({ID}) (touch/save_post hooks) but does not replace content. Unauthenticated users are blocked by the logged-in gate.

  src/Services/MachineTranslation.php:20-64

  Recommendation

  Replace has_logged_in_access with a real capability check: at minimum current_user_can('edit_post', (int) $request['postId']) on /order and the translation helpers, and current_user_can('edit_posts') on the remaining concierge routes. Refuse machine_translation orders unless the DeepL key is defined and the user can edit that specific post. Do not call wp_update_post without an edit_post check.

• medium Any logged-in user can place paid Concierge orders and trigger vendor/user emails

  missing_capability

  POST /bm-concierge/v1/order is registered as CREATABLE with permission_callback has_logged_in_access (is_user_logged_in only). process_order() switches on attacker-controlled JSON type (proofreading, accessibility, onpage, layout, machine_translation) and calls $service->order($data) with the full JSON body. BaseService::order() merges that body with pageName/pageUrl/websiteName/current user, then wp_mail()s an HTML job ticket to support@bernskioldmedia.com (Reply-To is the current user) and a confirmation to the current user's email stating the selected service, page, delivery speed, and that the price 'will be invoiced separately'. express, price, and (for onpage) keyword are taken from the JSON and echoed unescaped into the vendor email. A Subscriber can therefore spam the vendor, spoof a billable order against the site, and burn staff time, without edit_posts or any nonce beyond the REST cookie nonce every logged-in user can mint. This is not unauthenticated and does not write options/post meta; blast radius is email + potential vendor invoicing, so medium rather than high.

  src/Rest/Concierge.php:65-69, 159-194

  Recommendation

  Gate /order (and the price/language helpers if they should stay editor-only) on current_user_can('edit_post', $post_id) or a dedicated place_concierge_order capability defaulting to editors. Ignore client-supplied price; compute it server-side. Escape order-email fields (price, keyword, titles, URLs) and do not treat REST login as authorization to create billable work.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.