High-severity findings.

Audited release

1.1.1

Findings

2

Worst severity

high

Content hash

43561889fff709b018960aba… Copy

Findings

• high Unauthenticated REST lead form creates CRM contacts without magic-link verification

  missing_permission_callback

  DT_Porch_Lead_Form registers POST /wp-json/l/v1/p with permission_callback __return_true. DT_Porch_Landing always instantiates DT_Magic_Url_Base, whose authorize_url sets dt_allow_rest_access when REQUEST_URI contains l/v1/p, so Disciple.Tools' rest_authentication_errors lockdown does not apply to anonymous callers. endpoint() requires params['parts'] and params['action'] but never uses parts and never calls DT_Magic_URL::verify_rest_endpoint_permissions_on_post (the documented magic-link permission callback). action=followup sanitizes a small whitelist then DT_Posts::create_post('contacts', $fields, true, false) — the fourth argument skips can_create. Fields written: title, contact_email, contact_phone, type=access, notes (visitor IP or serialized Ipstack geo plus attacker comment), and assigned_to/overall_status/sources copied from option landing_content if present. Observable: a new published contacts row visible to D.T users, shared with the site base user when the request is unauthenticated, with no public_key, nonce, captcha, or rate limit. action=newsletter is the same unauth route: it curl PUTs the submitted email to Mailchimp using landing_content api key/list id with CURLOPT_SSL_VERIFYPEER false and returns the raw API body to the client. This plugin has no UI that writes landing_content; followup does not need that option.

  landing-pages/rest.php:29-173

  Recommendation

  Use DT_Magic_URL::verify_rest_endpoint_permissions_on_post (or equivalent public_key/meta_key match) as the permission_callback so only a published porch magic URL can submit. Keep field allowlisting. Add rate limiting and a captcha/honeypot on followup. Do not return Mailchimp curl bodies; enable CURLOPT_SSL_VERIFYPEER. Consider check_permissions=true plus a dedicated unauth create capability rather than a global skip.

• medium Porch re-enables Media and allows unsanitized SVG/ZIP uploads

  xss_stored

  DT_Porch_Landing_Media_Tab removes 'media' from dt_remove_menu_pages (restoring wp-admin upload.php that Disciple.Tools hides because uploads are world-readable) and add_filter('upload_mimes') unconditionally adds image/svg+xml, application/zip, PDF, Office docs, and CSV. The porch_admin role created by this plugin gets upload_files without manage_options or unfiltered_html. WordPress will store a crafted SVG in wp-content/uploads; the plugin's own admin notice states those files are publicly accessible. A porch_admin (or any other role that already had upload_files) can therefore plant a stored XSS document at a predictable public URL. ZIP is similarly allowed with no content inspection. Subscribers do not receive upload_files from this plugin.

  admin/admin-media-tab.php:25-49

  Recommendation

  Do not add image/svg+xml unless SVGs are sanitized (e.g. enshrined/svg-sanitize) and served with Content-Disposition: attachment or a locked-down CSP. Restrict the mime filter to users who need it, keep zip/doc out of a CRM uploads dir, and consider leaving DT's media menu hidden for non-administrators.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.