Thrive - Intranet WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.6.5

Findings

3

Worst severity

high

Content hash

be4164a00d95168c5d12db43… Copy

Findings

• high AJAX transaction handlers authorize with nonce only (no capability)

  missing_capability

  wp_ajax_thrive_transactions_request dispatches state-changing callbacks (add/edit/delete tickets, update/delete projects, comments) after wp_verify_nonce('thrive-transaction-request') only. No current_user_can/edit_post/group-membership gate runs in the dispatcher or in ThriveProject::save(). The nonce is embedded in front-end project templates for any logged-in viewer, so a Subscriber (or any authenticated user who can open a project page) can create/update published project posts via wp_insert_post and mutate tasks for arbitrary project_id values. Delete has a partial author/cap check in the model; create/update and task mutations do not.

  transactions/controller.php:47-113

  Recommendation

  For each callback, require an explicit capability (e.g. edit_post on the project, or BuddyPress group membership admin) in addition to the nonce. Reject Subscribers who are not project/group members. On ThriveProject::save(), call current_user_can('edit_post', $id) for updates and current_user_can('publish_posts') (or equivalent) for creates.

• high Project save path performs wp_insert_post without capability checks

  missing_capability

  ThriveProject::save() builds a published project post and calls wp_insert_post with no current_user_can check. Combined with the nonce-only AJAX update_project handler, any authenticated user holding the front-end nonce can publish or overwrite project posts (including setting ID to update another author's project) and assign thrive_project_group_id meta.

  models/project.php:71-117

  Recommendation

  Before wp_insert_post, verify the current user can create projects and, when ID is set, can edit_post that ID. Do not allow arbitrary ID updates from request input without ownership/cap checks.

• medium fetch_task allows caller-selected PHP callback via template parameter

  unsafe_input

  thrive_transaction_fetch_task reads GET/POST 'template' and, if function_exists($callback_template), invokes that function with task args. Although constrained to existing PHP functions, this is dynamic dispatch from request input and can invoke unexpected callables with attacker-influenced arrays (information disclosure / unexpected side effects).

  transactions/controller.php:182-218

  Recommendation

  Replace free-form function names with a strict allowlist of known render callbacks (e.g. only thrive_render_task).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.