High-severity findings.

Audited release

26.9.23-531

Findings

2

Worst severity

high

Content hash

c54beec2788ef9da1a7e32a4… Copy

Findings

• high Editor-level users can create/activate themes and write arbitrary theme template files via REST

  missing_capability

  All magic-wand/v1 routes share check_permission(), which returns true for current_user_can('edit_theme_options') OR current_user_can('edit_pages'). Editors (and shop managers) hold edit_pages, so they reach create_child_theme(), which creates a directory under get_theme_root() and calls switch_theme() (an action WordPress restricts to switch_themes / administrators), and save_template(), which writes request-supplied content verbatim (wp_unslash only) to <active stylesheet dir>/templates|parts/<slug>.html. Block template/part files are rendered without kses, so a page editor can inject arbitrary HTML/JavaScript into the header part of every front-end page and change the active theme. On multisite this also bypasses the lack of unfiltered_html for Editors.

  includes/class-xophz-compass-magic-wand-compiler.php:88-90,312-342,402-435

  Recommendation

  Use separate permission callbacks: require edit_theme_options (and edit_themes for file writes) for save-template, and switch_themes + install_themes for create-child-theme; keep edit_pages only for page-content routes.

• medium Page REST routes lack per-object capability checks (arbitrary post type read/overwrite)

  missing_capability

  get_pages() passes a request-controlled post_type to get_posts() including draft/pending/future statuses, get_page_content() returns raw post_content and rendered HTML for any post ID, and save_page() calls wp_update_post() on any ID with no current_user_can('edit_post', $id)/read_post check. Any edit_pages holder can therefore list/read content of arbitrary post types (e.g. private CPT records) and overwrite post_content/status of posts of types they could not otherwise edit.

  includes/class-xophz-compass-magic-wand-compiler.php:123-218

  Recommendation

  Restrict post_type to an allow-list (page) and check current_user_can('read_post'/'edit_post', $id) before returning or updating a post.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.