JQUEST Plugin WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.11.0

Findings

1

Worst severity

medium

Content hash

d6511d801fce0d94639473e1… Copy

Findings

• medium Games REST routes allow any logged-in user to read the org catalog and rewrite jquest_org_games

  missing_capability

  register_rest_route for GET /jquest/v1/games and POST /jquest/v1/games/refresh sets permission_callback to RestAPIHelpers::is_user_logged_in, which is a bare is_user_logged_in() check (Administrator/Editor/Author/Contributor/Subscriber/Customer all pass; unauthenticated fails). There is no current_user_can('edit_posts') or manage_options gate. GET returns get_option('jquest_org_id') and get_option('jquest_org_games') (quest ids, titles, versions). POST refresh_games() calls fetch_jquests() with the stored org id: wp_remote_get('https://api.jquest.fi/organizationgames-getorganizationgames?v2=true&orgId=' . $value) then update_option('jquest_org_games') / jquest_org_message; a null JSON body or success!==true writes jquest_org_games to an empty array. Bootstrap::localize_scripts() registers an empty front-end script and wp_localize_script()s jQuestPlugin.nonce = wp_create_nonce('wp_rest') on every public page, so a Subscriber can POST with credentials:'same-origin' and X-WP-Nonce from the homepage. Observable consequence: any customer/subscriber account can read the unpublished quiz catalog and force a site-wide option rewrite or wipe, which empties the admin/inserter picker and makes get_jquest_version() fall back to v1 for popups. This is not unauth RCE/XSS; blast is limited to those options.

  classes/RestAPI/APIs/JquestAPI.php:32-85

  Recommendation

  Gate GET /games on current_user_can('edit_posts') (the inserter is the only consumer). Gate POST /games/refresh on current_user_can('manage_options') so only administrators can rewrite jquest_org_games. Do not localize a wp_rest nonce on public pages unless a public REST consumer needs it. In fetch_jquests(), do not wipe jquest_org_games on transport/JSON failure.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.