High-severity findings.

Audited release

1.6.3

Findings

3

Worst severity

high

Content hash

9d1fe8bbe75b8efb36725e0c… Copy

Findings

• high Public CRM export tokens are SHA256 of userid+time()+site_id+rand(0,999)

  predictable_token

  Every format's create() builds the unauthenticated download secret as hash('sha256', get_current_user_id() . time() . dt_get_site_id() . rand(0, 999)). Formats/*.php then bootstrap wp-load.php with no current_user_can and stream the snapshot if the token hits transient metrics_exports_{token} or postmeta download_/permanent_{token}. The 64 hex chars look random, but input entropy is a small integer uid, second-resolution time(), PHP rand(0,999) (1000 values, not CSPRNG), and dt_site_id. This same plugin treats dt_site_id as a public site identifier: csv-format-ishare.php writes it into every CSV row as creator_organizationCode and identifier salt. dt_get_site_id() itself is hash('SHA256', site_url() . time()) at first use — site_url is public and activation-second is brute-forceable. Once site_id is known, an attacker who can bound export time (email, Referer, admin activity) only needs ~1000 SHA256 guesses per second of window. Help text claims the key is 'unguessable for brute force'. Observable consequence: unauthenticated dump of all contacts' names, emails, phones, and GPS via csv-format-contacts.php / json-format-contacts.php / kml-format-contacts.php / geojson-format-contacts.php (same token constructor copied across format files).

  formats/csv-format-contacts.php:104-110

  Recommendation

  Generate tokens with bin2hex(random_bytes(32)) or wp_generate_password(64, false, false). Do not mix dt_site_id into a secret if that value is also exported. Stop using rand()/time()/uid as token material. Prefer a front-controller under rest_api_init or admin-post with a capability or signed capability token instead of publicly executable format PHP files.

• medium Expiring export links last ~7 and ~70 days because TTL is string-concatenated

  insecure_config

  set_transient(..., 60 . 60 . 48) and set_transient(..., 60 . 60 . 360) use PHP's '.' operator, so the expiration is the integer 606048 seconds (~7.01 days) and 6060360 seconds (~70.1 days), not 48 hours (172800s) or 15 days (1296000s). The admin UI, notices, and Help tab tell operators the links die in 48 hours / 15 days; those are the values they use when mailing CRM dumps to partners. The same bug is copied into every format file and both extension templates. Combined with unauthenticated format PHP downloaders, a stolen or logged '48-hour' URL keeps serving names/emails/phones/GPS more than three times longer than advertised. iShare additionally calls delete_transient($token) instead of delete_transient('metrics_exports_'.$token), so its 'one-time' link is not burned on download either.

  formats/csv-format-contacts.php:107-123

  Recommendation

  Use multiplication: 60 * 60 * 48 and 60 * 60 * 360 (or HOUR_IN_SECONDS * 48 / DAY_IN_SECONDS * 15). Align notices and Help copy with the real TTL. For iShare, delete_transient('metrics_exports_' . $token) and point the download href at csv-format-ishare.php (the notice currently links format-csv-ishare.php).

• medium iShare export interpolates unsanitized all_locations into SQL after wp_unslash

  sql_injection

  DT_Metrics_Export_Tab_Location_Export::export() passes filter_post($_POST) into DT_Metrics_Export_CSV_COTW::create(). filter_post() runs dt_recursive_sanitize_array(), which does sanitize_text_field(wp_unslash($value)) — stripping magic quotes. create() then sets $intent_level = $response['all_locations'] (or each selected_locations value) and interpolates WHEN '{$intent_level}' into a large SELECT (phpcs:disable). The switch only copies an integer into $intent_level_int / spatial_intentLevel; $intent_level itself is never replaced with an allow-listed literal, including on default. sanitize_text_field does not escape SQL quotes. A manage_dt user (dt_admin has manage_dt but not manage_options) can POST action=export&format=csv_ishare&all_locations=admin0' OR SLEEP(5) OR '1'='1 and extract or UNION out of $wpdb. The same interpolation is used in the country_by_country loop. Grid ids are correctly passed as prepare %s; only $intent_level/$intent_level_int are interpolated, and the int is safe.

  formats/csv-format-ishare.php:291-352

  Recommendation

  Map $intent_level through an explicit allow-list (admin0–admin5, raw) and only interpolate that constant, or bind it with $wpdb->prepare('%s', $safe_level). Do not wp_unslash user input into concatenated SQL. Keep phpcs enabled on this query.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.