Event Tickets Extension: PDF Tickets WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.4

Findings

2

Worst severity

high

Content hash

689d784c50d5889635996a0a… Copy

Findings

• high Unauthenticated access to ticket PDFs with attendee PII and check-in codes

  missing_auth

  load_pdf() on template_redirect treats the attendee unique_id as the sole authorization token: there is no is_user_logged_in(), current_user_can(), or nonce check, and attendee_allowed_to_and_expected_to_attend() is not applied. A valid unique_id streams the PDF with readfile(); if the file is missing the handler generates it via do_upload_pdf() and 307-redirects. Unique IDs are created with uniqid('', true) (microtime + LCG, not a CSPRNG) and stored in post meta _tribe_ext_pdf_tickets_unique_id. The same files are written to the public uploads directory as tribe_tickets_{unique_id}.pdf (filterable prefix, no .htaccess/index protection). Direct GETs to that URL bypass PHP, X-Robots-Tag, and the rewrite wrapper. Ticket PDFs include holder name/email, Event Tickets security/QR codes used at check-in, and any Event Tickets Plus attendee fields copied from the email template. An unauthenticated visitor who obtains a unique_id (email attachment filename, “View your tickets” link, access logs, referrer, backups, or uploads directory listing) can download or regenerate any attendee’s ticket.

  tribe-ext-pdf-tickets.php:1666-1744

  Recommendation

  Store PDFs outside the web root or in a directory denied by web server config (WooCommerce-style uploads/.htaccess). Replace uniqid() with wp_generate_password() / wp_generate_uuid4(). Authorize downloads with a login+ownership check or an HMAC-signed, expiring URL; do not expose get_direct_pdf_url() paths. Apply attendee_allowed_to_and_expected_to_attend() (and trash/refund checks) inside load_pdf before generating or streaming.

• low Web-accessible mPDF out.php streams/deletes tmp PDFs and reflects unsanitized headers

  unnecessary_attack_surface

  The shipped vendor tree includes mPDF’s example helper vendor/mpdf/mpdf/data/out.php, which is executable via a direct plugin URL. It concatenates $_REQUEST['filename'] with .pdf under ../tmp/, serves the file, unlinks it, and inserts $_REQUEST['opname'] into Content-Disposition without sanitization (CRLF/header injection). Slash checks block path traversal but not access to any PDF already in that tmp directory. This plugin sets mPDF tempDir to get_temp_dir(), so live ticket PDFs are not stored there by default; the script is leftover attack surface in a production zip.

  vendor/mpdf/mpdf/data/out.php:1-68

  Recommendation

  Exclude mPDF example/helper scripts (data/out.php, functions-dev.php) from the distributed plugin via composer archive exclude or delete them. Never expose raw $_REQUEST values in HTTP headers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.