Disciple.Tools - Share App WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.2.1

Findings

1

Worst severity

high

Content hash

33b9c3c2b77940afd5314bb9… Copy

Findings

• high Unauthenticated REST share-app endpoint creates CRM contacts and leaks GPS reports without magic-link verification

  missing_permission_callback

  DT_Share_Magic_Link always instantiates DT_Magic_Url_Base, whose authorize_url sets dt_allow_rest_access when REQUEST_URI contains share_app/v1/ocf, so Disciple.Tools' rest_authentication_errors lockdown does not apply to anonymous callers. add_endpoints() registers POST /wp-json/share_app/v1/ocf with no permission_callback (WordPress treats that as public). endpoint() requires params['parts'] and params['action'] then uses the client-supplied parts object as-is; it never calls DT_Magic_URL::verify_rest_endpoint_permissions_on_post (the theme helper that binds public_key/meta_key to post_id). action=followup sanitizes name/phone/email then DT_Posts::create_post('contacts', $fields, false, false) — the fourth argument skips can_create, the third is not silent so assigned users are notified. Fields written: title, assigned_to (from get_post_meta(parts.post_id, 'corresponds_to_user')), subassigned to that post_id, type=access, contact_phone, contact_email, notes. action=log inserts attacker GPS into $wpdb->dt_reports. action=geojson returns every share_app/ocf lat/lng/label for attacker-chosen post_id. Observable: a new published contacts row (shared with the site base user when uid=0), assignment notifications, and a GeoJSON dump of field-worker locations. Sequential contact IDs are enough; no magic key, nonce, captcha, or rate limit.

  magic-link/magic-link-ocf.php:169-336

  Recommendation

  Use DT_Magic_URL::verify_rest_endpoint_permissions_on_post (or an equivalent public_key/meta_key match that re-resolves post_id server-side) as the permission_callback so only a valid share_app/ocf magic URL can call the route. Do not trust client-supplied parts.post_id. Keep the field allowlist. Add rate limiting on followup/log. Prefer check_permissions=true plus a dedicated unauth create path rather than a global skip; consider silent=true if notifications should not fire for public submissions.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.