Medium-severity findings.

Audited release

1.4.6

Findings

1

Worst severity

medium

Content hash

5adef353e54554075a15b154… Copy

Findings

• medium Mailchimp subscribe/unsubscribe capability is UI-only

  missing_capability

  The plugin creates capability admin_mailchimp and a Mailchimp Admin role whose documented purpose is to subscribe/unsubscribe contacts. dt_details_additional_tiles only adds the Mailchimp tile when current_user_can('admin_mailchimp') (and get_the_ID() is set), so multipliers do not see the fields in the contact UI. The same file's dt_custom_fields still registers dt_mailchimp_subscribed_mc_lists, dt_mailchimp_fname, and dt_mailchimp_lname for every contacts viewer, with list ids in field defaults, and does not set a capability/hidden/readonly flag. Disciple.Tools REST (DT_Posts::update_post) accepts any registered field if the user can_update the post; it does not consult tile visibility. dt_mailchimp_auto_subscribe (dt_post_updated) then pushes status subscribed/unsubscribed to Mailchimp with no capability check. A multiplier (or any role with share-based contact update, without admin_mailchimp) can therefore opt a contact into a Mailchimp audience or remove them, sending CRM emails/PII to Mailchimp and enabling campaign mail. This is the bypass the maintainers tried to prevent for GDPR/consent reasons.

  tile/custom-tile.php:32-38,69-107,159-174

  Recommendation

  Enforce admin_mailchimp on the write path, not only the tile. In dt_custom_fields, omit or mark hidden/readonly the Mailchimp fields unless current_user_can('admin_mailchimp'), and/or hook dt_post_update_fields / dt_update_post_check_proceed to strip dt_mailchimp_* keys for users without that capability. In dt_mailchimp_auto_subscribe, return unless current_user_can('admin_mailchimp') (cron/MC→DT sync already uses check_permissions=false and should keep using a dedicated internal path). Filter dt_after_get_post_fields_filter so list membership is not returned to unauthorized viewers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.