High-severity findings.

Audited release

2.0.11

Findings

2

Worst severity

high

Content hash

da81c066807ab1ba1bf0f389… Copy

Findings

• high Any logged-in user can reset settings and mass-delete publications (no capability or nonce)

  missing_capability

  wp_ajax_reset_open_govpub is registered without a nopriv twin, so WordPress only requires a logged-in session. reset_open_govpub_data() never calls current_user_can or wp_verify_nonce/check_ajax_referer. The Reset admin form (views/reset.php) posts to admin-ajax.php with hidden action=reset_open_govpub and no wp_nonce_field; the menu that renders it is manage_options, but the AJAX worker is not. A Subscriber can POST reset=statistics|posts|all: ImportOptions::reset() deletes option open_govpub_options; reset=all also Settings::reset() deletes open_govpub_settings (the creator organization); posts/all run deletePublications() which WP_Query's open_govpub (250 per request) and wp_delete_post($id, true) (bypass trash). That CPT is the public REST catalog, so this wipes the site's official publications and, after reset=all, stops the daily/hourly cron import because creator is empty. The same missing nonce is CSRF: an unauthenticated page can submit the form using any logged-in victim's cookies. POST referer is passed to wp_redirect() (not wp_safe_redirect), so the attacker also gets an open redirect. The file even has a nearby @todo add nonce validation on the admin notice, but the handler itself was left ungated.

  src/Providers/SettingsProvider.php:29,91-157

  Recommendation

  Require current_user_can('manage_options') and check_ajax_referer() (matching a nonce output on the Reset screen) before any reset branch. Replace wp_redirect($referer) with wp_safe_redirect() to admin.php?page=open-govpub-settings. Do not accept an arbitrary POST referer.

• medium Any logged-in user can trigger the government-publication import job (no capability or nonce)

  missing_capability

  wp_ajax_import_open_govpub maps to import_open_govpub_data() with no current_user_can and no nonce check. Admin JS (assets/dist/js/admin.*.js) POSTs {action: import_open_govpub, checked: 0|1} to the localized ajaxurl and is enqueued on every admin page (admin_enqueue_scripts with no hook_suffix gate), but a Subscriber does not need that script: a raw POST is enough. checked=0 calls check_import_publications() (locks, SRU probe, writes open_govpub_options current_import/total_import); checked=1 calls run_import_publications() which wp_remote_get's the hardcoded overheid.nl SRU endpoints and PublicationService::create/update (wp_insert_post/wp_update_post plus identifier/permalink/search_meta). Cron already schedules those same methods, so this is not catalog destruction, but it is an unprivileged/CSRF-able state change: start or continue a bulk import, mutate catalog posts, and generate outbound HTTP/load. Limited blast versus the reset handler, hence medium.

  src/Providers/ImportProvider.php:47,185-227

  Recommendation

  Require current_user_can('manage_options') and check_ajax_referer() in import_open_govpub_data(). Localize a nonce only on the Import options screen (not every admin page) and send it from admin.js.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.