Medium-severity findings.

Audited release

0.4

Findings

2

Worst severity

medium

Content hash

2254c5e3fb76531368f7b4c1… Copy

Findings

• medium Missing nonce on Outline VPN webhook trigger allows CSRF of manage_dt users

  csrf

  On admin init, action_init() handles REQUEST action=trigger_outline_vpn_webhook by checking only current_user_can('manage_dt') then calling wp_remote_post() to the configured webhook with $_REQUEST['email']. No wp_verify_nonce/check_admin_referer. A strategist/dispatcher with an open wp-admin session can be CSRF'd into issuing/resending a VPN key to an attacker-controlled email. The Users row 'Send VPN key' link is a bare GET without nonce.

  disciple-tools-outline-vpn.php:128-186

  Recommendation

  Require check_admin_referer (or equivalent) tied to the target user/email before firing the webhook, and use POST for the Users-row action.

• low Unescaped email reflected in admin success notice

  xss_reflected

  After a successful webhook call, $_REQUEST['email'] is concatenated into an admin HTML notice without esc_html(), enabling reflected HTML/JS injection in wp-admin for users who already passed manage_dt.

  disciple-tools-outline-vpn.php:164-168

  Recommendation

  Echo esc_html( $email ) (and sanitize_email on input).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.