Medium-severity findings.

Audited release

0.3.0

Findings

2

Worst severity

medium

Content hash

0dd4a5bf4d99394d9134937d… Copy

Findings

• medium Logged-in users can dump Codeable CRM data and trigger API sync without capability or nonce checks

  missing_capability

  wp_ajax_wpcable_reload_tasks, wp_ajax_wpcable_sync_start, and wp_ajax_wpcable_sync_process are registered for every logged-in user. None of the three call current_user_can() or wp_verify_nonce(). A Subscriber POSTing action=wpcable_reload_tasks to admin-ajax.php receives the full task list JSON (private notes, client names, avatars, task titles, contractor/client dollar amounts) that the plugin otherwise only renders on manage_options screens. The same user can call wpcable_sync_start then wpcable_sync_process to drive wpcable_api_data::process_queue, which authenticates to https://api.codeable.io/ with the site's stored Bearer token, writes wpcable_account_details / wpcable_average / wpcable_balance / wpcable_revenue / wpcable_api_queue, and can mark open tasks lost. Because admin-ajax.php reads action from $_REQUEST and there is no nonce, a CSRF GET/POST from any logged-in session also works. Sibling wpcable_ajax_update_task is nonce-only (action wpcable-task, no current_user_can); that nonce is localized only on the tasks admin page and is uid-scoped, so a Subscriber cannot update rows unless another bug leaks a nonce for their uid.

  functions/admin-tasks.php:32-65

  Recommendation

  On every wp_ajax_ handler require current_user_can('manage_options') and check_ajax_referer() (or wp_verify_nonce of a localized admin nonce). Do not treat is_user_logged_in() as authorization. Fail closed with wp_send_json_error / wp_die(-1) instead of returning the CRM payload.

• medium Plugin admin pages reflect unsanitized error/success and date query parameters as HTML

  xss_reflected

  codeable_get_message_param() reads $_REQUEST['error'] or $_REQUEST['success'], base64-decodes the value, splits on commas, urldecodes, and returns the strings. codeable_admin_notices() (called from the stats, tasks, and settings callbacks) then echo implode('<br />', $errors) / $success unless the token is the hardcoded 'credentials' or 'fetched'. Those admin pages require manage_options, so this is administrator reflected XSS: a crafted link such as admin.php?page=codeable_settings&error=PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg== (base64 of <script>alert(1)</script>) executes in the admin session. Magic quotes wrap the base64 blob, not the decoded HTML, so they do not neutralize the payload. Sibling sinks on the stats page echo $_GET['date_from'], date_to, compare_date_from, and compare_date_to into input value attributes with no esc_attr, which is an attribute-context breakout on the same manage_options screen.

  functions/helpers.php:67-168

  Recommendation

  Treat error/success query values as an allowlist of known message keys, not as HTML. Escape any residual text with esc_html() (or wp_kses with an explicit tag list if bold labels are required). Echo all date query args with esc_attr(). Prefer passing messages via a short-lived transient instead of the URL.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.