Disciple.Tools - Import WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.3.1

Findings

1

Worst severity

high

Content hash

cae71d2198a0218c035cfdca… Copy

Findings

• high Geocode REST writes location_grid_meta to any post using only view_project_metrics

  missing_permission_callback

  Disciple_Tools_Import_Endpoints registers POST dt_import/v1/add_location_grid_meta and leftover POST dt/v1/sample/private_endpoint with permission_callback __return_true, so WordPress admits unauthenticated and low-privilege callers into the callback. private_endpoint() then allows the request if current_user_can('dt_all_access_contacts') OR current_user_can('view_project_metrics'). view_project_metrics is the Disciple.Tools 'All Metrics' cap: Strategist has it and nothing else (no manage_dt, no contact create/update). The handler never calls DT_Posts::can_update() on $params['id']. It geocodes attacker-supplied address/lat,lng with the site Google or Mapbox key, then Location_Grid_Meta::add_location_grid_meta() (theme helper, no auth of its own) add_post_meta's location_grid and location_grid_meta and inserts dt_location_grid_meta. Those keys are what DT maps render. CSV import UI that is supposed to own this flow is separately gated by manage_dt, so the REST surface is strictly wider than the admin page. Cookie REST still requires X-WP-Nonce to authenticate, which logged-in DT users have on metrics pages; application passwords skip the nonce. Unauthenticated and Subscriber/Multiplier callers fail has_permission() and do not write. Leftover GET dt-public/v1/sample/public_endpoint is the same __return_true pattern but only verifies a site-link transfer_token and returns true.

  includes/rest-api.php:9-76,91-187

  Recommendation

  Put a real permission_callback on both write routes (reject uid 0; require current_user_can to update the target record, e.g. DT_Posts::can_update( $post_type, $id ) or manage_dt). Do not treat view_project_metrics as a write gate. Delete the leftover dt-public/v1/sample/public_endpoint and dt/v1/sample/private_endpoint starter routes. Validate id/post_type/geocoder against an allow-list before calling geocoders or Location_Grid_Meta.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.