High-severity findings.

Audited release

0.3.4

Findings

1

Worst severity

high

Content hash

f5b9be3cf34ad82a6d07f54c… Copy

Findings

• high CSRF via nonce-less GET auto-starts irreversible PII and user-email wipe

  csrf

  The admin UI exposes a GET link admin.php?page=pii_obliterator&obliterate=true with no nonce or confirmation. content() only checks current_user_can('manage_dt') (administrator or Disciple.Tools Admin, not manage_options). When obliterate is set and step is absent, main_column() prints a setTimeout that navigates to step=1 with a freshly minted wp_create_nonce('obliterate'+uid) for the victim, then each of steps 1–8 verifies that nonce and immediately JS-redirects to the next step. SameSite=Lax still sends auth cookies on a top-level GET navigation, so an attacker page that sets location to the bootstrap URL (or a GET form submit) causes a logged-in manage_dt user to irreversibly rewrite all contact/group titles, all other users' display names and emails, phone/address/email meta, and delete activity-log rows plus any comment containing '@'. Steps 1–8 are not independently CSRF-able without the bootstrap, but the bootstrap issues the nonce to the victim's browser and auto-submits it. The plugin is documented as local-dev-only and does not refuse wp_get_environment_type()==='production'.

  disciple-tools-pii-obliterator.php:179-200

  Recommendation

  Do not change state on GET. Require POST, check_admin_referer() (or wp_verify_nonce) on the first action as well as later steps, and a typed confirmation string. Abort unless wp_get_environment_type() is local or development. Consider requiring manage_options rather than manage_dt. Replace the JS GET redirect chain with admin-ajax/REST calls that send the nonce in a header or POST body.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.