Low-severity findings only.

Audited release

0.6.7

Findings

1

Worst severity

low

Content hash

8d05fef5c6b9077ad9c66ed8… Copy

Findings

• low Unauthenticated REST route toggles dt_demo_hide_popup with no capability check

  missing_auth

  DT_Demo_Endpoints registers POST dt_demo/v1/quick_launch/hide_on_startup with permission_callback __return_true (same as the install/delete/add_* siblings). Unlike those siblings, hide_on_startup() never calls user_can(..., 'manage_dt'). WordPress REST cookie auth, when no X-WP-Nonce is sent, sets the current user to 0 and still dispatches the callback, so an unauthenticated POST to /wp-json/dt_demo/v1/quick_launch/hide_on_startup flips option dt_demo_hide_popup between 0 and 1. Logged-in non-admins can do the same: dt_demo_scripts localizes wpApiDemo.nonce on every front-end and admin page for any logged-in user. Consumers are only the manage_options sample-content welcome modal and the admin checkbox — a cosmetic flag, not contact data or demo install. The other 16 dt_demo/v1 write routes keep an inner manage_dt check, and missing-nonce cookie requests are treated as uid 0 so they are not CSRF-able as the admin.

  includes/rest-endpoints.php:56-62,182-190

  Recommendation

  Replace permission_callback __return_true on every dt_demo/v1 route with a callback that returns current_user_can('manage_dt') (or manage_options for hide_on_startup). Add the same user_can check inside hide_on_startup before update_option. Keep the inner manage_dt guards on install/delete/add_* as defense in depth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.