Critical findings.

Audited release

0.99.285

Findings

10

Worst severity

critical

Content hash

48bce428fcfe02d2bd4720d9… Copy

Findings

• critical Unauthenticated DocSpace download path traversal reads arbitrary files

  file_access

  AmapressDocSpace for the 'public' space (and public-* subfolders) is constructed with an empty download_capability. hasCurrentUserDownloadRight() treats an empty cap as allow-everyone, including unauthenticated callers of admin_post_nopriv_amp_docspace_download_public. handleDownload concatenates urldecode($_GET['file']) onto getUploadDir() with no basename, realpath, or prefix check, then readfile()s any existing path. From wp-content/uploads/amapress-docspace/public/, four ../ segments reach ABSPATH, so file=../../../../wp-config.php (or %2e%2e encodings) discloses database credentials. The same concatenation in handleRemove (upload cap edit_posts) can unlink traversed files. .htaccess DENY FROM ALL on the docspace directory does not apply to this PHP download wrapper.

  modules/docspace/AmapressDocSpace.php:415-449

  Recommendation

  Reject any file name containing '..', NUL, or a directory separator; resolve realpath and require it stay under getUploadDir(). Do not treat an empty capability as public-unauthenticated unless that is explicit, and even then never concatenate raw user input onto a filesystem path. Apply the same checks to handleRemove and handleUpload.

• critical Shipped PHPUnit eval-stdin.php allows unauthenticated RCE (CVE-2017-9841)

  rce

  The GitHub release zip vendors phpunit/phpunit 4.8.36 (composer.lock packages-dev) under a web-accessible plugin path with no vendor/.htaccess or index.php. vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php is the unpatched CVE-2017-9841 artifact: eval('?>' . file_get_contents('php://stdin')) with no PHP_SAPI === 'cli' guard. On SAPIs that map the HTTP request body to php://stdin (PHP CGI/FastCGI as originally exploited), an unauthenticated POST of PHP source executes as the web user. This file has been mass-scanned since 2017. It must not ship in a production WordPress plugin regardless of SAPI.

  vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php:1-3

  Recommendation

  Stop shipping composer --dev packages (phpunit, phpdocumentor, faker, wpcs, etc.) in the plugin zip. Delete vendor/phpunit. Add an Apache/Nginx rule denying PHP execution under vendor/. If tests must remain in git, exclude them from the distributable archive.

• high ICS calendar key mints a full WordPress login cookie

  auth_bypass

  Amapress_Agenda_ICAL_Export::export_events() (feed agenda-ical) calls AmapressUser::logUserByLoginKey($_GET['key']) for unauthenticated visitors. The key is md5(uniqid()) stored forever in usermeta amapress_user_key and appended to private ICS URLs via addUserLoginKey(). logUserByLoginKey looks up that meta and calls wp_set_current_user + wp_set_auth_cookie + wp_login. Anyone who obtains the ICS URL (Google/Apple Calendar subscription, mail, proxy logs, referrer) can open it in a browser and receive a persistent session as that member, including administrators if they used the private feed. The token never expires or rotates and is not a calendar-only capability.

  entities/amapien/classes.php:1188-1220

  Recommendation

  Do not set auth cookies from a calendar token. If the ICS request needs a user context, set the current user for that request only (no cookie, no wp_login). Use a high-entropy random token (wp_generate_password / random_bytes), rotate it, and scope it to feed generation.

• high Any logged-in user can install and activate Git Updater via AJAX

  missing_capability

  utils/install-github-updater.php is loaded on every request (unless FREE_PAGES_PERSO). wp_ajax_github_updater → ajax_router() takes $_POST['method'] from a whitelist (install, activate, dismiss) and invokes $this->$method() with no current_user_can('install_plugins'), no nonce, and no admin referer check. install() runs Plugin_Upgrader against https://github.com/afragen/git-updater/archive/master.zip and activate() calls activate_plugin(). wp_ajax_ is reachable by an amapien/Subscriber from frontend admin-ajax.php; amapress_check_access explicitly skips DOING_AJAX. CSRF from an administrator session also works. Subscriber cannot choose an arbitrary zip, but they can change site plugin state without install_plugins.

  utils/install-github-updater.php:90-100

  Recommendation

  Require current_user_can('install_plugins') and check_ajax_referer before install/activate. Do not register the AJAX action unless the notice is actually shown to an administrator.

• high Logged-in users can download any member's contract or adhesion bulletin

  information_disclosure

  On amapress_init (every front-end request), inscr_assistant=generate_contrat and generate_bulletin stream a generated DOCX. The HMAC inscr_key check runs only when the visitor is not logged in. A logged-in amapien skips that check; the handler then loads AmapressAdhesion / AmapressAdhesion_paiement by attacker-supplied inscr_id / adh_id with no ownership or capability test and calls generateContratDoc / generateBulletinDoc + sendDocumentFile. IDs are sequential custom posts, so enumerating them exfiltrates every member's contract (identity, address, quantities, payment schedule). Contrast stripe_callback in the same file, which does verify hash and adherent ids.

  entities/contrat_adhesion/shortcodes.php:236-279

  Recommendation

  Always require the HMAC (or a per-document capability). For logged-in users, require the current user to be the adherent, a co-adherent, or amapress_can_access_admin(). Apply the same ownership check used in the stripe_callback step.

• high Inverted authorization lets any member register or remove other users

  auth_bypass

  Several wp_ajax handlers intended to allow a distribution responsable (or admin) to act on another user_id use `if ( ! $is_current && ! ( ! isResponsable || canAdmin ) ) deny`. De Morgan: the deny branch is taken only when the caller IS a responsable and is NOT admin. For an amapien/Subscriber (isResponsable=false, canAdmin=false) acting on another user, the inner expression is true and the outer deny is skipped, so the action proceeds. Affected: wp_ajax_desinscrire_visite_action / inscrire_visite_action, desinscrire_amap_event_action / inscrire_amap_event_action, desinscrire_garde, distrib_desinscrire_slot. Contrast inscrire_garde / distrib_inscrire_slot / assemblee handlers, which correctly use `!(isResponsable || canAdmin)`. No nonce. Observable: POST admin-ajax.php action=desinscrire_visite_action&visite=ID&user=VICTIM as any logged-in member removes the victim from the visit.

  entities/visite/shortcodes.php:166-193

  Recommendation

  Use a single positive check: allow if $is_current || amapress_can_access_admin() || isCurrentUserResponsable(...). Add check_ajax_referer. Repeat the fix in entities/amap_event/shortcodes.php and entities/distribution/actions.php (desinscrire_garde, distrib_desinscrire_slot).

• high Any logged-in user can cancel or validate another member's basket exchange

  missing_capability

  wp_ajax_annuler_adherent / annuler_repreneur / validate_reprise / reject_reprise take panier IDs from $_REQUEST with no nonce and no check that the current user is the adherent, the repreneur, or an admin. cancelFromAdherent($user_id=null) defaults the mail recipient to the current user but still setStatus('cancelled') on the target AmapressIntermittence_panier. validateReprise assigns an arbitrary repreneur_id. Members' weekly vegetable baskets can be cancelled or given to someone else by any other logged-in amapien who can guess or list panier post IDs.

  entities/intermittence/actions.php:387-504

  Recommendation

  In each method, require the current user to be the adherent (cancelFromAdherent), the asking/assigned repreneur (cancelFromRepreneur), or amapress_can_access_admin(). Add a nonce. Do not accept a comma-separated list of foreign panier IDs.

• high DocSpace upload has no capability or type check and allows path traversal

  rce

  handleUpload (wp_ajax_amp_upload_docspace_*) verifies nonce amp_upload_file only — no current_user_can, no wp_check_filetype, no sanitization of $_FILES['file']['name']. The file is move_uploaded_file'd to getUploadDir().$name, so a name of ../../../themes/twentytwentyfour/shell.php writes a webshell outside the .htaccess-protected docspace directory and bypasses WordPress upload MIME limits. The nonce is printed in the shortcode form for users with upload_capability (edit_posts: editor/responsable-class roles). Those roles are below manage_options and should not get unfiltered PHP write. handleRemove likewise concatenates $_GET['name'] and unlinks.

  modules/docspace/AmapressDocSpace.php:184-207

  Recommendation

  Re-check upload_capability in the handler. Use sanitize_file_name / basename only, reject '..', and pass the file through wp_check_filetype_and_ext with a strict allow-list. Store only under getUploadDir().

• high PHP 7 type juggling bypasses inscription HMAC (unauthenticated user creation)

  auth_bypass

  Unauthenticated handlers compare amapress_sha_secret($key) (sha1 hex) to intval($_POST['inscr-key']) with ==. Sending inscr-key=foo yields integer 0. On PHP < 8, a sha1 that does not begin with a digit loosely equals 0, so the check passes after a few random key values. Plugin Requires PHP 5.6. Affected admin_post_nopriv: inscription_amap_extern (creates a WP user with role amapien and assigns an AMAPIEN_GROUP term), inscription_intermittent (creates user + intermittent list), and wp_ajax_nopriv_inscrire_distrib_action / desinscrire_distrib_action (registers arbitrary user_id as distribution responsable). On PHP 8 the comparison fail-closes (legitimate hashes also fail after intval).

  entities/amapien/actions.php:382-423

  Recommendation

  Compare the full sha1 with hash_equals(amapress_sha_secret($key), (string) $_POST['inscr-key']). Never intval a hex MAC. Apply the same fix in entities/intermittence/actions.php and entities/distribution/shortcodes.php.

• high Logged-in users can invoke arbitrary actions via event scheduler admin-post

  missing_capability

  admin_post_tf_event_scheduler_resend and admin_post_tf_event_scheduler_test take hook_name and JSON args from the request and call do_action($hook_name, $args) with no capability check and no nonce. amapress_check_access returns early for admin-post.php, so an amapien/Subscriber can POST admin-post.php?action=tf_event_scheduler_resend. That fires any hooked action (plugin recall/mail crons, other plugins' actions that accept one array argument). The test variant also redirects all mail to the current user's email.

  amapress.php:1968-1995

  Recommendation

  Restrict to amapress_can_access_admin() (or manage_options), verify a nonce, and allow-list hook names the scheduler actually registers instead of passing client-supplied hook_name to do_action.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.