AI Gateway WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.2

Findings

2

Worst severity

high

Content hash

79b889cddbef7a655d984e51… Copy

Findings

• high Contributor+ conversation-draft REST overwrites any post stored in draft_post_id

  missing_capability

  POST /ai/v1/conversations/(id)/draft is registered with permission_callback current_user_can('edit_posts') only. Every other conversation/project route requires edit_pages, so a default Contributor is denied list/get/create on ai_conversation but is still admitted here. The handler accepts any numeric id, checks only that the row is post_type ai_conversation, then reads post meta draft_post_id and calls wp_update_post() on that ID with attacker-controlled title/content and post_status=draft — no current_user_can('edit_post'|'edit_others_posts'), no ownership check, no post-type check on the target. Studio (src/studio.js) auto-POSTs this route ~1.2s after any chat change, so in-use conversations almost always have draft_post_id set to the auto-saved 'Chat: …' post. A Contributor who can load Gutenberg already has a wp_rest nonce (AIGatewaySettings plus core wp-api-fetch). They brute sequential conversation IDs (private CPT, not listable to them, but IDs are ordinary wp_posts IDs). Observable: the target wp_posts row's post_content is replaced with the JSON messages dump and post_status is forced to draft, which unpublishes the post if an editor had published that Studio auto-save. If draft_post_id is empty they still wp_insert_post a draft and write draft_post_id onto the victim conversation. Default Authors cannot otherwise edit another author's posts; Contributors cannot edit others' drafts. This is object-level BAC on wp_update_post, not a missing REST nonce (cookie auth still needs wp_rest, which Gutenberg provides).

  rest/handlers-studio.php:172-226

  Recommendation

  Align this route with the other conversation endpoints (current_user_can('edit_pages') or the configured studio capability). Before wp_update_post, require current_user_can('edit_post', $draft_id), verify the target is the expected post type/status, and never force a published post back to draft from this autosave. Do not write draft_post_id on conversations the caller cannot edit.

• medium Contributor+ media import sideloads remote files without upload_files

  missing_capability

  POST /ai/v1/media/import is registered with permission_callback current_user_can('edit_posts') and the handler never re-checks upload_files. A default Contributor can create drafts in Gutenberg (so they receive the plugin's wp_rest nonce via enqueue_block_editor_assets) but cannot use core Media Upload. This route takes an attacker-supplied url, esc_url_raw + download_url (wp_safe_remote_get, so classic private-IP SSRF is largely mitigated by core), then media_handle_sideload() using basename($url) as the filename. Allowed MIME types still apply, so this is not unfiltered PHP upload/RCE; it is a capability bypass that writes a new attachment post and a file under wp-content/uploads and returns {attachment_id, url}. Authors already have upload_files, so the privilege jump is Contributor (and any custom role with edit_posts but not upload_files). Additional impact: unbounded remote fetch (download_url default timeout 300s, no size cap) as a low-grade worker DoS. Studio's Upload panel calls this same route; Studio itself is edit_pages, but the REST gate is the weaker edit_posts check.

  rest/handlers-media.php:7-38

  Recommendation

  Require current_user_can('upload_files') in permission_callback and inside the handler. Restrict sideload to an image/document allowlist, cap download size, and reject non-http(s) URLs even if esc_url_raw accepted them.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.