High-severity findings.

Audited release

0.4.1

Findings

2

Worst severity

high

Content hash

f3f0db7cb908dd34a7f3618f… Copy

Findings

• high Unauthenticated REST proxy of the privileged Dovetail authorization episode API

  missing_permission_callback

  GET /wp-json/dovetail/v1/episodes/{id} (id constrained to [a-f0-9-]+) is registered with permission_callback __return_true. rest_get_episode calls get_episode(), which GETs https://podcasts.dovetail.prx.org/api/v1/authorization/episodes/{id} with the site's OAuth Bearer token and returns enclosure, uncut (original/processing media), media[], itunesType, explicit flags, season/episode numbers, cleanTitle, and author. That authorization API is the authenticated feeder used by the editor metabox to poll processing status — not the public RSS enclosure. Combined with finding 3, episode UUIDs for every published podcast post are listed in public /wp/v2 REST under meta._dovetail_podcasts_episode.dovetail.id, so no UUID guessing is required. Observable: unauthenticated read of unpublished/in-progress uncut originals and internal Dovetail episode fields for any episode the connected client application can access. On failure, rest_response() returns WP_Error('rest_no_route', ..., $api_response) which serializes the full wp_remote response (headers/body) into the REST error data.

  src/classes/Dovetail/DovetailApi.php:108-209

  Recommendation

  Gate the route with current_user_can('edit_posts') (or edit_post on a related post) plus a REST nonce. Alternatively, if a public poll is required for the frontend player, return only fields that are already public on the published enclosure (href, duration) and never uncut/originalUrl/author internals. Do not attach the raw wp_remote response to WP_Error data.

• high Public post REST and player render expose private episode meta and write it on GET

  information_disclosure

  PostMetaBox::init hooks rest_prepare_{$post_type} for every configured podcast post type with no capability check. On GET, rest_prepare calls get_episode_meta_data($post_id) and copies the full array onto $response->data['meta'][ _dovetail_podcasts_episode ]. WordPress treats underscore-prefixed keys as private and would not expose this without that hook; the metabox JS relies on it (with an X-WP-Nonce) for the block editor. Because there is no current_user_can('edit_post') / is_user_logged_in() guard, unauthenticated GET /wp-json/wp/v2/posts/{id} (and other public types) receives Dovetail episode UUIDs, uncut/original media, enclosure, podcastId, and author. get_episode_meta_data itself is state-changing: it calls the privileged Dovetail authorization APIs (list podcasts, lookup by guid/title, get_episode) using site credentials, then add_post_meta/update_post_meta. The same write-on-GET path runs on the frontend from Player::get_attributes_from_post_context (block/shortcode render and page view). Attacker does not choose the written bytes (they come from Dovetail), but they can force authenticated outbound API usage and persist/refresh privileged fields onto public REST. This is also the UUID oracle for the unauthenticated /dovetail/v1/episodes/{id} proxy.

  src/classes/Admin/MetaBox/PostMetaBox.php:62-121

  Recommendation

  Only attach _dovetail_podcasts_episode to REST responses when current_user_can('edit_post', $post_id). Do not call Dovetail or update_post_meta from rest_prepare/get_attributes_from_post_context on unauthenticated/public requests; persist Dovetail refreshes from save_post or a capability-gated cron/REST poll. If the public player only needs src/duration, expose those via a dedicated public-safe helper instead of the full private meta blob.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.