High-severity findings.

Audited release

1.6

Findings

1

Worst severity

high

Content hash

9c85ab41e347a90cae42beab… Copy

Findings

• high Bulk messaging REST route allows public access via __return_true

  missing_permission_callback

  register_rest_route for POST /dt/v1/(?P<post_type>\w+)/bulk_messaging sets permission_callback to __return_true. The callback bulk_messaging() immediately invokes email or Twilio senders with attacker-controlled post_ids/settings. Authorization is deferred to DT_Posts::get_post permission checks inside the senders, so unauthenticated callers get per-item failures but the route itself admits everyone and any principal who can read contacts can trigger bulk outbound messaging and magic-link meta writes.

  includes/rest-api.php:67-107

  Recommendation

  Replace __return_true with a callback that requires a logged-in user with an appropriate Disciple.Tools capability (e.g. access_contacts / manage_dt) before invoking senders.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.