Email Download WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ #2 in Email & Notifications

High-severity findings.

Audited release

0.9

Findings

2

Worst severity

high

Content hash

aa784b247e0181a14ceeada6… Copy

Findings

• high Public REST route grants gated file downloads for any Mailchimp member email without proving ownership

  missing_auth

  POST /wp-json/dwnload/v1/user/{email} is registered through RouteService with permission_callback __return_true. The only check is wp_verify_nonce on X-WP-Nonce action wp_rest; Scripts::registerScripts localizes that nonce for every visitor (including uid 0) on pages that render the shortcode or block, and the form also outputs wp_nonce_field('wp_rest'). After decrypting the page's hidden list_id, the handler loads the site Mailchimp API key from email_download_mailchimp and GETs lists/{list_id}/members/{md5(email)}. DrewM\MailChimp treats any HTTP 2xx as success(); Mailchimp returns 200 for subscribed, unsubscribed, pending, cleaned, and archived members whenever the address exists on the list. The code never reads $response['status'] and never sends a confirmation to the mailbox. On success it builds an encrypted GET /dwnload/v1/download/{token} URL (email||hash||attachment_url||file_id||expiry, +2 days) which DownloadController serves with permission_callback __return_true and no second Mailchimp check. Distinct success vs 'It seems you're not subscribed.' is a membership oracle. Rate limiting (transient email_download_{md5(UA+LOCAL_ADDR+LOCAL_PORT+REMOTE_ADDR)}) is bypassed by changing User-Agent; a successful grant also delete_transient()s the key. Observable as unauthenticated: harvest list_id and file_id from the public form HTML, POST a guessed list member (site owner, info@, leaked audience dump), follow response.url, receive the gated attachment.

  src/RestApi/SubscriptionController.php:44-156

  Recommendation

  Do not treat knowledge of an email address as authorization. Send a one-time link to the submitted address (or require login) and only then issue the download token. Require Mailchimp status === 'subscribed'. Keep the REST route public if needed but stop using the site API key as an unauthenticated membership oracle; return a generic message in both member and non-member cases. Bind rate limits to IP (not User-Agent) and do not reset the limiter on success. Re-check membership (or a one-time token) on the download GET.

• medium Gated file_id is not bound to the Mailchimp list, so form tokens can be swapped

  auth_bypass

  The shortcode/block render encrypted hidden fields independently: list_id = encrypt(list-id attribute) and file_id = encrypt(attachment_id || computer_id). validateUserEmailSubscription decrypts list_id for the Mailchimp member lookup, then getFileIdFromRequest() decrypts file_id and takes only explode('||', $data)[0] as absint attachment ID. The computer_id suffix from buildDataForFieldId() is never compared to the requester, and nothing checks that this file was the one configured for that list. An attacker who is a member of list B (or who can pass finding 1 with a list-B email) copies the file_id ciphertext from a list-A form on another public page and POSTs it with list B's ciphertext. wp_get_attachment_url($file_id) then feeds buildDownloadRestUrl for the list-A attachment. Concrete: two published forms, [email_to_download list-id="premium" file="10"] and [email_to_download list-id="newsletter" file="11"]; newsletter members retrieve attachment 10.

  src/Api/Api.php:89-104

  Recommendation

  Encrypt a single payload that includes list_id, file_id, and a server-side secret (or HMAC), and reject requests where the decrypted list and file do not match a stored allowlist of shortcode/block configurations. Drop the unused computer_id suffix or actually verify it. Do not accept a file_id ciphertext that did not originate with the same list_id ciphertext.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.