Medium-severity findings.

Audited release

0.6.5

Findings

2

Worst severity

medium

Content hash

66d45212adcd78383b2cad3d… Copy

Findings

• medium Unauthenticated magic-map REST returns location grid without magic-key verification

  missing_auth

  Disciple_Tools_AI_Magic_Map_App registers REST route starter_app/v1/map with permission_callback __return_true. The endpoint only checks that params include parts and action; for action=geojson it never validates the magic URL public_key/parts against DT_Magic_URL and instead queries all level-0 rows from dt_location_grid and returns them as GeoJSON. Any unauthenticated caller can POST {"action":"geojson","parts":{}} and obtain the site's location-grid dataset. The companion non-object magic REST similarly uses __return_true and returns true for arbitrary actions (low-value stub).

  magic-link/magic-link-map.php:240-311

  Recommendation

  Use DT_Magic_URL::verify_rest_endpoint_permissions (or equivalent) in permission_callback / before endpoint_geojson, and reject requests whose parts fail verification. Do not expose geojson without a valid magic link secret.

• low Starter non-object magic REST admits all callers

  unnecessary_attack_surface

  magic-link-non-object.php registers a CREATABLE route with permission_callback __return_true and its endpoint returns true for get/excited/default without verifying magic parts or performing meaningful authorization. Low blast radius but expands unauthenticated attack surface.

  magic-link/magic-link-non-object.php:174-196

  Recommendation

  Remove the stub route from production builds or gate it with magic-link verification / capability checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.