WP Sortables WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.1.0

Findings

1

Worst severity

medium

Content hash

939e1c03dcd61c80ebdf24c3… Copy

Findings

• medium Making a type sortable silently enables its full public REST controller

  information_disclosure

  Core::init_sortables() (init priority 15, before rest_api_init actually registers routes) reads sortable_post_types / sortable_taxonomies and, for each selected slug, sets show_in_rest=true on the global object, invents rest_base if empty, and assigns WP_REST_Posts_Controller / WP_REST_Terms_Controller when none is set. The settings UI lists every show_ui type with no warning that this publishes the type to REST. WordPress core then treats every post with status publish as anonymously readable (WP_REST_Posts_Controller::check_read_permission) and every term as anonymously readable (get_item_permissions_check returns true). A Subscriber or unauthenticated visitor can therefore dump title/content/excerpt of published objects for CPTs or taxonomies that were registered public=false / show_in_rest=false (internal tools, form entries stored as publish, private vocabularies). Writes still require edit_post/edit_term, and a default install stores empty option arrays so nothing is exposed until an admin saves the Sortables screen. The drag-and-drop script only needs menu_order; exposing the entire posts/terms controller is unnecessary.

  include/Sortables/Core/Core.php:118-170

  Recommendation

  Do not flip show_in_rest on types that opted out. Persist order through a dedicated REST route or admin-ajax action that accepts only {id, menu_order}, checks current_user_can('edit_post'| 'edit_term', $id) plus a nonce, and leaves the type's REST visibility unchanged. If REST must stay, restrict the controller to authenticated users with edit caps (filter rest_authentication_errors / rest_{type}_query) and never assign WP_REST_Posts_Controller to private CPTs. Document that enabling a type currently exposes it at /wp-json/wp/v2/.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.