High-severity findings.

Audited release

3.2.16

Findings

3

Worst severity

high

Content hash

e8411ba0bb21322a9693c999… Copy

Findings

• high REST routes register with no permission_callback and dump full post content to anonymous callers

  missing_permission_callback

  CreateRouter always registers six GET routes under namespace aeria. Route::register() calls register_rest_route() with only methods and callback — no permission_callback. Since WordPress 5.5 that is a _doing_it_wrong notice; the permission check is skipped, so the handlers run for unauthenticated requests (no REST nonce on GET). /wp-json/aeria/search passes the entire WP_REST_Request param bag into Query::getPosts, which forwards attacker-controlled s, post_type, post_parent, orderby, order, numberposts (default -1), and suppress_filters (default true unless the string "false") to get_posts() and returns raw post_content, post_author, post_excerpt, and post_name. Unlike core /wp/v2/posts, password-protected posts (status still publish) are returned with full content; suppress_filters=true also bypasses membership/visibility plugins that hide published posts via the_posts. post_type=attachment (get_posts auto-sets post_status=inherit) lists the media library. /wp-json/aeria/post-types?public=0 uses the falsy string "0" so get_post_types(['public'=>false]) returns the full WP_Post_Type objects (caps, labels) for private types such as revision, shop_order, and wp_template, which /search can then query if they have published posts. /taxonomies and /terms take attacker-controlled taxonomy/post_type and will list non-public taxonomies. /validate and /validate-by-id are similarly public. Any theme route loaded from aeria-config inherits the same public default, including POST/PUT/DELETE. These endpoints are intended for the admin relation/terms UI but are not gated on edit_posts.

  Aeria/Router/Route.php:57-70

  Recommendation

  Add an explicit permission_callback on every register_rest_route. Built-in /search, /post-types, /taxonomies, /terms, and /validate* should require current_user_can('edit_posts') (or a dedicated aeria capability). Do not return raw post_content for password-protected posts; respect post_password and the post type's public/show_in_rest flags; cap numberposts; default suppress_filters to false; reject public=0 for anonymous callers. Require theme-defined routes to declare a permission_callback in config and refuse to register POST/PUT/DELETE without one.

• high Unauthenticated /aeria/search wraps get_posts and returns full post_content including password-protected posts

  information_disclosure

  The /wp-json/aeria/search callback (CreateRouter) is `return $args['service']['query']->getPosts($wp_req->get_params())` with no capability check. Query::getPosts copies request parameters into get_posts() and, unless sender=SelectOptions, maps every hit to ID, post_author, post_name, post_type, post_title, post_date, post_content, post_excerpt, and post_modified. numberposts defaults to -1 (entire result set in one response). post_status is not forwarded, so WP defaults to publish — which still includes password-protected posts; get_posts returns their unredacted post_content, whereas core REST sets content.protected and empties the body. Combined with /post-types?public=0, an unauthenticated caller learns private CPT slugs and can request any type that stores rows as publish. Concrete observable: GET /wp-json/aeria/search returns JSON of all published posts' full HTML; GET /wp-json/aeria/search?post_type=page does the same for pages; GET /wp-json/aeria/search?post_type=attachment lists attachment titles, descriptions, and slugs.

  Aeria/Query/Query.php:202-262

  Recommendation

  Gate /search on edit_posts (or is_user_logged_in plus a post-type-specific read cap). Strip or refuse password-protected posts unless the caller knows the password. Do not accept arbitrary post_type values; allow-list public, show_in_rest types. Default numberposts to a small page size. Keep suppress_filters false so membership filters still run. Return only id/title for the admin SelectOptions consumer.

• medium No upstream maintenance path for the unauthenticated REST disclosure

  unmaintained

  Tag 3.2.16 (this tree) was cut 2021-01-25 ("feat: added suppress_filters parameter in get posts"). caffeinalab/aeria last commit on master is 2022-04-12 (client package bump only); GitHub issues are disabled (has_issues: false); the plugin header has no Update URI. The bundled Updater reads GitHub /releases and will not see a fix because no newer tag exists. An application kit that ships public REST search of post_content is not safe to run unpatched; the high findings above have no in-tree remediation.

  aeria.php:9-17

  Recommendation

  Do not deploy this plugin on production sites until the REST routes gain permission_callback and content redaction, or replace it with a maintained fields/CPT framework (ACF, CMB2, etc.). If you must keep it, add a must-use mu-plugin that rest_authentication_errors-denies the aeria namespace for unauthenticated users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.