NOVA Bridge Suite WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

2.8.10

Findings

3

Worst severity

high

Content hash

d0112c33a19c2917f94db4bf… Copy

Findings

• high WPML translation API lets any Contributor overwrite or publish translations of any post/term

  missing_capability

  WTAI_REST_Controller::permissions_check() only requires current_user_can('edit_posts') for every wpml-translations/v1 route. create_translations() passes the caller-supplied source_post_id to WTAI_Translation_Service::upsert_post_translation(), which looks up the existing WPML translation and calls wp_update_post() on it (or wp_insert_post() for a new one) with caller-controlled title, content, slug, parent, post_status and post_author, without any edit_post/publish_posts/edit_others_posts check on the source or target. A Contributor can therefore deface or replace administrator-owned published pages in any translated language, publish content without review, and attribute it to another author; /terms similarly creates/updates term translations without manage_categories. Content passes wp_kses_post, so this is content tampering/SEO spam rather than script injection. Only active when the admin enables the WPML bridge module.

  modules/wpml/includes/class-wtai-rest-controller.php:109-112

  Recommendation

  In permissions_check (or per item) require current_user_can('edit_post', $source_post_id) and, for an existing translation, current_user_can('edit_post', $existing_translation_id); require publish_posts before honouring a 'publish' status and edit_others_posts before setting a foreign post_author; require edit_term/manage_categories for term routes.

• medium Gutenberg bridge list route exposes drafts/private posts of any post type to Subscribers

  information_disclosure

  nova_gut_permission_check() allows any GET without an id when current_user_can('read'), which every Subscriber/customer has. nova_gut_list_pages() then runs WP_Query with a caller-chosen post_type and post_status defaulting to 'any' (no perm=readable), and with slug= or include_content=1 returns post_content plus SEO meta. A low-privileged user can read unpublished, pending, scheduled and private content of any post type, including CPTs that store form submissions. Only active when the Gutenberg bridge module is enabled.

  modules/gutenberg/includes/pages.php:26-38

  Recommendation

  Require edit_posts (or edit_pages for pages) for the collection route, restrict post_type to post/page, and add 'perm' => 'readable' or filter results with current_user_can('read_post', $id).

• low meta_all REST field writes arbitrary (including protected underscore) post meta

  unsafe_input

  cf_tmrb_update_post_meta_all_payload() checks edit_post on the target post but then writes any key in the payload via update_post_meta(), including protected keys (_wp_page_template, page-builder data, SEO plugin keys) that core REST refuses unless explicitly registered. Values are passed through wp_kses_post, limiting script injection, but a Contributor/Author can still set internal meta on their own posts that other plugins trust.

  modules/bridge/nova-bridge.php:2537-2672

  Recommendation

  Skip keys where is_protected_meta($key, 'post') is true unless current_user_can('edit_post_meta', $post_id, $key) passes, or use an explicit allow-list of supported keys.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.