High-severity findings.

Audited release

5.2

Findings

5

Worst severity

high

Content hash

306a148c52168645eba78961… Copy

Findings

• high Unauthenticated REST /cf/v2/activities exposes editorial comment threads and selected draft text for any post

  missing_permission_callback

  The cf/v2 namespace registers /activities, /activitiesCount and /getuserdata with permission_callback check_activity_permits(), which simply returns true. get_activities() takes any postID and dumps every _el* comment thread on that post. The output includes comment bodies ('thread'), attachment links, the quoted selected text from the content ('selectedText' = commentedOnText), resolver and assignee names and roles, and author info. It does not check post status or read permission, so an anonymous visitor can enumerate post IDs and read internal editorial discussions and excerpts of unpublished drafts, private and pending posts. /getuserdata?userid=N likewise lists every user's display name and roles anonymously, which identifies administrators.

  admin/classes/class-commenting-block-rest-routes.php:33-72, 132-160, 254-262, 533-555

  Recommendation

  Require current_user_can('edit_post', $postID) in the permission callback for activities/activitiesCount, and at least is_user_logged_in() plus list_users/edit_posts for getuserdata.

• high Plugin grants unfiltered_html to Author and Contributor roles (and bypasses the multisite restriction)

  insecure_config

  cf_custom_caps() runs on every admin_init and permanently adds the unfiltered_html capability to the 'author' and 'contributor' roles. cf_add_unfiltered_html_capability_to_users() is hooked to map_meta_cap at priority 1. It rewrites the unfiltered_html meta cap to the primitive cap for any administrator, editor, author or contributor, which overrides core's 'do_not_allow' on multisite. With this, a Contributor can save raw <script> in post content. The script runs when an editor or administrator previews or reviews the pending post (which can be used to create an admin user or change options), and on the front end once the post is published. This turns a low-trust role into a stored-XSS path to admin.

  admin/classes/class-commenting-block-admin.php:69-73, 720-745

  Recommendation

  Remove the role/meta-cap grants (and remove the cap from existing roles on upgrade). Allow the plugin's own mdspan markup by extending wp_kses_allowed_html for the 'post' context.

• high Comment AJAX handlers lack nonce and capability checks: any Subscriber can add/edit/delete/resolve editorial comments on any post and write arbitrary post meta keys

  missing_capability

  cf_add_comment, cf_update_comment, cf_delete_comment, cf_resolve_thread and cf_update_meta are registered as wp_ajax_* (any logged-in user). They perform no check_ajax_referer, no current_user_can and no edit_post check on currentPostID. cf_add_comment writes update_post_meta($current_post_id, $metaId, $superCareerData) where both the post ID and the meta key come from the request, so a Subscriber can create or overwrite arbitrary unprotected and underscore-protected meta keys (with array values) on any post. They can also inject, rewrite, delete or resolve editorial comment threads on posts they cannot edit, and overwrite _autodraft_ids. Assigning a thread also queues assignment emails to arbitrary users. All of these are CSRF-able for logged-in editors as well.

  admin/classes/class-commenting-block-admin.php:1388-1470, 1615-1670, 1822-1845, 1925-1935

  Recommendation

  Add check_ajax_referer(COMMENTING_NONCE) and current_user_can('edit_post', $current_post_id) to every comment handler, and restrict $metaId to the plugin's /^_el[0-9a-z-]+$/ key pattern.

• medium Subscriber can read any user's email address via cf_add_comment assignTo

  information_disclosure

  cf_add_comment (no nonce or capability check) accepts assignTo=<any user ID>. It stores that ID and returns assignedTo => {ID, display_name, user_email, avatar} from get_user_by('ID', ...). A Subscriber can iterate user IDs and harvest every account's email address, administrators included.

  admin/classes/class-commenting-block-admin.php:1393, 1449-1452, 1473-1494

  Recommendation

  Gate the handler (see above) and allow assignment only to users who can edit the post. Do not return user_email to the client.

• medium Plugin settings handlers (suggestions / email notification / suggestion mode) have no nonce or capability check

  missing_capability

  cf_save_suggestions, cf_save_email_notification and cf_save_suggestions_mode are wp_ajax_* handlers with no check_ajax_referer and no current_user_can. Any Subscriber, or a CSRF against an admin, can change site-wide workflow settings. cf_give_alert_message='stop' blocks publishing while suggestions are open. cf_admin_notif turns super-admin notifications on or off. cf_suggestion_mode_option_name forces suggestion mode on all posts. cf_specific_post_*_values are stored raw from $_POST. These values feed the editor's behavior through wp_localize_script and the notification logic.

  admin/classes/class-commenting-block-admin.php:1716-1792

  Recommendation

  Require current_user_can('manage_options') and verify the 'multicollab_general_nonce' nonce, as cf_save_settings already does for the nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.