CRIVE Trasporti WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.3

Findings

2

Worst severity

high

Content hash

77cb6f13dcf607ed39d891b3… Copy

Findings

• high Unauthenticated disclosure of medical transport requests via admin_init 'edit_request' action (missing capability check / IDOR)

  missing_auth

  AdminPage::handle_actions() is hooked to admin_init, which WordPress fires for every request to /wp-admin/admin-post.php and /wp-admin/admin-ajax.php, including unauthenticated ones, and for any logged-in user on /wp-admin/. When $_GET['action'] === 'edit_request' it calls render_edit_request_page() and exits, without current_user_can(), page check or nonce. The page loads the row for the attacker-supplied request_id and renders views/edit-request-form.php, which prints the requester's full name, phone, e-mail, pickup/destination address, date and place of birth, codice fiscale and reason for the medical transport. IDs are sequential, so an anonymous attacker can dump every request.

  src/Admin/AdminPage.php:187-265

  Recommendation

  Only handle the action on the plugin's admin page (check $_GET['page'] === 'crive-transport-requests') and require current_user_can('manage_options') (or manage_crive_trasporti) plus a nonce before rendering; render the page from the menu callback instead of admin_init.

• low Request PDFs with personal data written to a predictable public uploads path

  information_disclosure

  PDFGenerator::generate() writes uploads/cri-requests/request-<id>.pdf (sequential id, no index protection) containing the full request before mailing it; the file is deleted after wp_mail, but if mailing hangs/fatals it remains web-accessible until the daily cron removes files older than 72 hours.

  src/Includes/PDFGenerator.php:81-97

  Recommendation

  Generate the attachment in a non-public temp dir (get_temp_dir()/wp_tempnam) with a random name, or protect the directory with deny rules.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.