High-severity findings.

Audited release

1.9

Findings

1

Worst severity

high

Content hash

25f884c0fe344bd5c42a916c… Copy

Findings

• high Public REST /content bypasses the Disciple.Tools login wall

  missing_permission_callback

  register_rest_route('static-section/v1','/content') uses methods CREATABLE and permission_callback __return_true. content_endpoint() only checks that JSON param id is set, then returns get_ss_content($id) — get_post_meta(ss_post_id, 'nav_menu_content_'.$id) — with no is_user_logged_in(), current_user_can(), or has_permission() call. The same HTML is rendered on /ss/ and /metrics/ss/ through theme template-metrics.php, which calls dt_please_log_in() and requires access_disciple_tools or view_project_metrics; metrics-mode constructor even bails without has_permission(). The browser client still sends X-WP-Nonce, but core does not enforce a REST nonce when the request is unauthenticated and the callback returns true. Anyone who knows or is given a section id (URL hash /ss/#<id>, localized dtStatic.nav_ids, CSS class on the menu) can POST {"id":"..."} and receive iframe/report HTML that the CRM login wall was meant to hide. If the dt_static_section storage post has not been created yet, the same unauth request wp_insert_post()s it via get_ss_post_id().

  disciple-tools-static-section.php:653-674

  Recommendation

  Replace __return_true with a permission_callback that requires is_user_logged_in() and the same caps as the page: current_user_can('access_disciple_tools') || current_user_can('view_project_metrics'), or reuse has_permission() after aligning its caps with the theme (access_contacts, not dt_access_contacts). Do not call get_ss_post_id()'s insert path from an unauthenticated request. Keep sending the wp_rest nonce from static.js so cookie-authenticated callers satisfy core REST CSRF checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.