Volunteer Manager WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.0

Findings

2

Worst severity

high

Content hash

2b3042413cd65160ca558138… Copy

Findings

• high Any logged-in user can export all volunteer national identity numbers as CSV

  missing_capability

  Employee::addHooks attaches triggerCSVDownload to admin_init. handleEmployeeExport() runs whenever $_GET['export_users'] equals csv, with no current_user_can, no nonce, and no post-type/page check. admin_init fires for every wp-admin request, including a Subscriber hitting /wp-admin/?export_users=csv (the handler exit()s before the dashboard capability redirect). queryEmployees() loads every employee post (post_status any) and streams first name, surname, Swedish national identity number, email, and phone as exported_volunteers_YYYY-MM-DD.csv. Observable consequence: a Subscriber (or any other logged-in role) bulk-downloads personnummer and contact PII for every volunteer in the system.

  source/php/PostType/Employee/EmployeeExport.php:24-36

  Recommendation

  Gate the export on a capability such as edit_others_posts or manage_options, verify a nonce from the export button, and only run on the employee list screen. Do not hook a download that calls exit() on unconditional admin_init.

• high Broken nonce and missing capability allow any logged-in user to change any post's status

  missing_capability

  admin_post_update_post_status maps to Assignment::updatePostStatus. UrlBuilder creates the nonce with action update_post_status, but the handler verifies edit_post_status, so wp_verify_nonce always fails. On failure the code wp_redirect()s without exit, so execution continues into get_post($postId)/wp_update_post() regardless. There is no current_user_can('edit_post') (or even a check that the post is an assignment). admin-post.php is reachable by every logged-in user, including Subscriber, via GET. Observable consequence: a Subscriber or a CSRF'd admin can set post_status to publish, draft, or trash for an arbitrary post_id (publish attacker-created pending assignments, unpublish or trash pages/posts). Combined with the public assignment REST, this is a publish primitive for unauthenticated content.

  source/php/PostType/Assignment/Assignment.php:127-151

  Recommendation

  Verify nonce with the same action used in UrlBuilder (update_post_status), exit after a failed check, require current_user_can('edit_post', $postId), allow only assignment posts, and whitelist post_status to publish/draft.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.