Disciple.Tools - Reporting App WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.4

Findings

3

Worst severity

high

Content hash

62708e8d2fbe072e47943cb0… Copy

Findings

• high Unauthenticated reporter registration returns magic portal link in API response

  auth_bypass

  REST route reporting_app/v1/access uses permission_callback __return_true. Action new_registration creates a contacts post with reporting_app_portal_magic_key and returns {status: CREATED, link: <portal URL with key>} to the caller. An unauthenticated attacker can self-register with an arbitrary email and receive the magic-link token without proving mailbox control, then use the portal endpoints (profile/church updates) authenticated by that key.

  magic/access.php:63-97,144-239

  Recommendation

  Do not return the magic link in the REST response; only email it. Require proof of email ownership (confirmation code) before creating the portal key. Keep permission_callback public only for the email-send path that does not disclose secrets.

• medium Mapbox metrics REST routes use permission_callback __return_true

  missing_permission_callback

  cluster_geojson/get_grid_totals/get_list_by_grid_id/points_geojson for practitioners and churches register with permission_callback __return_true. Callbacks do call has_permission(), so data is not publicly dumped, but REST authentication/authorization is deferred past WordPress's permission_callback layer (cookie auth not enforced at route gate).

  charts/mapbox-maps-practitioners.php:75-111

  Recommendation

  Set permission_callback to a closure that calls $this->has_permission() so unauthorized requests are rejected at the REST layer with 401/403.

• low Notice dismiss AJAX can set arbitrary dismissed-* options

  missing_capability

  dt_hook_ajax_notice_handler verifies a nonce then update_option('dismissed-' . $type, true) with attacker-controlled type. Blast radius is limited to options prefixed dismissed-, but any logged-in user who can obtain the admin-notice nonce can flip those flags.

  disciple-tools-reporting-app.php:239-246

  Recommendation

  Allowlist known notice type slugs and require manage_options (or manage_dt).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.