Medium-severity findings.

Audited release

2.7.1

Findings

2

Worst severity

medium

Content hash

173032d70b3479a2c9cae30d… Copy

Findings

• medium meeting_times updates write or delete arbitrary post meta keys

  unsafe_input

  dt_post_update_fields is applied by Disciple_Tools theme DT_Posts::update_post after can_update() and before field allowlisting. For trainings, any meeting_times[] object with a client-supplied key is passed straight to update_post_meta($post_id, $field['key'], $field['value']) or delete_post_meta($post_id, $field['key']) with no prefix check that the key starts with meeting_times_. A Multiplier who can edit a training (access_trainings/update_trainings on a record they own or are shared with) can POST /wp-json/dt-posts/v2/trainings/{id} with meeting_times:[{key:'assigned_to',value:'user-N'}], {key:'status',value:'...'}, or {key:'_any_protected_key',delete:true} and change or remove meta that the datetime_series UI is not supposed to touch. Blast is that one post (not site-wide options or other users' posts); new keys are generated with meeting_times_ + unique_hash and are safe.

  post-type/module-base.php:618-644

  Recommendation

  Accept only keys that match /^meeting_times_[a-zA-Z0-9]+$/ (or that already exist as meeting_times_* on this post). Ignore or reject any other key. Unset meeting_times from $fields after handling so later update_post_meta loops cannot reuse the array.

• medium Training map REST accepts arbitrary post_type and lists other records' titles and coordinates

  information_disclosure

  DT_Metrics_Mapbox_Trainings_Maps registers POST dt-metrics/trainings/{cluster_geojson,get_grid_totals,get_list_by_grid_id,points_geojson} with permission_callback __return_true. Routes are only added when the current user has view_any_trainings or view_project_metrics (constructor gate) and a Mapbox key exists; unauth/Multiplier therefore get 404. Once registered, handlers take post_type and query from the JSON body. $this->base_filter is empty, so the query is not forced onto trainings. Disciple_Tools_Mapping_Queries::cluster_geojson / query_under_location_grid_meta_id then return post_title, post_id, lng, lat for that type. The plugin-defined training_admin role has view_any_trainings but not view_any_contacts; POSTing {post_type:'contacts',query:{}} returns every mapped contact name and coordinates. get_list_by_grid_id also skips the inner has_permission() check that the sibling methods have. Personal-map class (access_trainings, assigned_to=me) is the same pattern but scoped to the current user.

  metrics/mapbox-maps.php:76-170

  Recommendation

  Hard-code post_type to 'trainings' (or ignore the body and use $this->post_type). Put the same has_permission() check on get_list_by_grid_id. Replace permission_callback __return_true with a callback that calls has_permission() so routes are not world-callable if registration timing ever changes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.