High-severity findings.

Audited release

2.0.0-rc.5

Findings

3

Worst severity

high

Content hash

56242a0d10cf7364c93dd847… Copy

Findings

• high Coaching-tree reparent allows any logged-in user to rewrite group hierarchy

  missing_capability

  POST /autolink/api/coaching-tree is gated only by LoggedIn + CheckShareCookie (no nonce, no DT can_update). The 403 fires only when $new_group is empty AND the group's assigned_to is not the current user. Supplying a real new_parent makes $new_group truthy, so the assignment check is skipped. The handler then DELETE/INSERT rows in $wpdb->p2p for p2p_type groups_to_groups using attacker-supplied self/previous_parent/new_parent. Observable: parent/child church tree on /autolink/coaching-tree and DT group parent_groups connections.

  src/Controllers/CoachingTreeController.php:76-131

  Recommendation

  Require DT_Posts::can_update on both groups, deny moves unless the user is assigned/shared, add Nonce middleware (action dt-autolink) to the API POST, and invert the permission condition so a valid destination does not skip the owner check.

• medium IDOR read of arbitrary groups and contacts

  information_disclosure

  Authenticated GET /autolink/groups/{group_id}/modal returns JSON with DT_Posts::get_post('groups', $group_id, true, false) (permissions skipped) plus rendered modal HTML. GET /autolink/groups/{group_id}/edit and parent-group-field likewise call get_post/list_posts with check_permissions false, including DT_Posts::get_post('contacts', $leader_id, false, false) for attacker-supplied leaders[]. Sequential post IDs leak names, leaders, members, locations, health metrics, and related contact graphs. Consumer: al-ajax-form injects the HTML; the JSON 'post' object is used to initialize Mapbox/edit UI.

  src/Controllers/GroupController.php:91-98

  Recommendation

  Use DT_Posts::get_post/list_posts with check_permissions true (default) and return 403 when can_view fails. Do not accept arbitrary contact IDs in leaders[] without can_view.

• medium State-changing Autolink API routes have no nonce

  csrf

  routes/api.php applies only LoggedIn and CheckShareCookie to POST /autolink/api/coaching-tree, POST /autolink/api/field, and POST /autolink/api/language. Frontend sends X-WP-Nonce: $autolink.nonce (action dt-autolink), but Nonce middleware is not registered on these routes (unlike web POST groups/survey and admin settings). Cookie-authenticated browsers will execute those POSTs. FieldController::update writes health_metrics/member_count/etc. via DT_Posts::update_post for id groups_{id}_{field}; CoachingTreeController::update rewrites p2p; LanguageController::switch updates the user's locale. SameSite=Lax reduces cross-site POST CSRF on modern browsers but does not replace a nonce on a cookie-auth API.

  routes/api.php:17-24

  Recommendation

  Attach the existing Nonce middleware (config plugin.nonce / header X-WP-Nonce) to all Autolink API POSTs, matching the web mutation group.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.