High-severity findings.

Audited release

1.1.5

Findings

2

Worst severity

high

Content hash

628824d57aac0886a8f58aca… Copy

Findings

• high Team Member broken access control: unscoped wp_p2p join grants view/update outside the user's teams

  auth_bypass

  DT_Posts::can_view() and can_update() apply dt_can_view_permission / dt_can_update_permission. For any post type except teams, a user with access_specific_teams (the team_member role this plugin registers; not view_any_contacts) is passed through can_view_update_post(). That helper is documented as 'posts that the user's teams are assigned to' but the SQL only constrains user_team.p2p_from = {user's corresponds_to_contact} and then joins team_posts on user_team.p2p_to = team_posts.p2p_from with no p2p_type on either hop. Any two-hop posts-2-posts path therefore grants both view and update: e.g. the member's contact --contacts_to_groups--> a group --groups_to_leaders--> other contacts, or --contacts_to_contacts--> a coachee --*--> that coachee's connections. List queries are correctly scoped via get_user_teams() (p2p_type teams_to_contacts) and dt_filter_access_permissions, so the extra records do not appear in lists — a classic IDOR. Observable on GET/POST /wp-json/dt-posts/v2/{post_type}/{id} (and the single-record UI, comments, field updates): HTTP 200 and field writes for records the user is not assigned to via a team. team_collaborator/leader/admin already have dt_all_access_contacts so they are not newly elevated. WP Subscriber never receives access_specific_teams.

  post-type/module-base.php:400-447

  Recommendation

  Restrict both hops to the team p2p types this module actually uses (user_team.p2p_type = 'teams_to_contacts' and team_posts.p2p_type IN / LIKE '%_to_teams'), or reuse get_user_teams() plus a typed p2p lookup of posts assigned to those team IDs. Keep can_view and can_update in lockstep with dt_filter_access_permissions so IDOR by numeric post ID is impossible. Add tests that a team_member in a group or coaching relationship cannot GET/PATCH a contact that is not assigned to their team.

• high Stored XSS in List Team Contacts magic-link onclick via contact name

  xss_stored

  Team_Assigned_List::body() prints each assigned contact as a table row whose onclick handler is built with esc_html(str_replace("'", ''', $assigned['name'])). That is the wrong context: esc_html() (ENT_QUOTES, double_encode false) emits ' or leaves ' intact, and the HTML attribute decoder turns those entities back into a raw apostrophe before JavaScript runs, breaking out of the single-quoted get_assigned_details('post_type','id','NAME') string. A team_member (or anyone who can update a team-assigned contact, including a magic-link visitor if the admin enabled the DT name/text field on the template) can set post_title to e.g. x');alert(document.domain);//. The page is the unauthenticated magic-link UI (token in jsObject.parts). Observable: opening the list-team-contacts magic link executes the attacker's script in the token holder's browser; the script can read jsObject.parts and call the parent magic-link REST update endpoint against every listed contact. Cell text uses esc_html correctly; only the onclick sink is executable.

  magic-link/templates/assigned-to-team.php:277-280

  Recommendation

  Do not concatenate user-controlled strings into onclick. Pass id/post_type/name via data-* attributes (esc_attr) and bind a click listener in JS, or emit the arguments with esc_js()/wp_json_encode() so apostrophes remain JS-escaped after HTML decoding. Keep the visible name on esc_html.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.