AI Agent for Website WP Registry grade D. High-severity findings · 5 findingsWP RegistryHigh-severity findings · 5 findingsOpen the reportD

High-severity findings.

Audited release

1.10.0

Findings

5

Worst severity

high

Content hash

de8ca83811de1643c9c596fb… Copy

Findings

• high Unauthenticated live-agent REST IDORs: read any chat, impersonate agents, end sessions

  missing_auth

  When Live Agent mode is enabled, /wp-json/ai-agent/v1/live-agent/messages, /message, /end, /connect, and /session-status are registered with permission_callback __return_true. live_session_id is an autoincrement integer with no proof of session ownership. An unauthenticated caller can enumerate IDs and dump wp_aiagent_live_messages (visitor support transcripts). POST /message accepts attacker-controlled sender_type and sender_id; send_message() only checks that the session exists and is active, so sender_type=agent inserts a fake agent message. The frontend widget treats sender_type==='agent' as a human agent and runs formatMessage(), which turns markdown [text](url) into <a href="url"> without a javascript:/data: allowlist — so injected agent messages can phish visitors. POST /end calls end_session() on any ID and tears down active support chats. No nonce is required for unauthenticated REST.

  includes/class-rest-api.php:1021-1105

  Recommendation

  Require a secret per-session token (the 16-char session_id) plus proof of role: visitors may only send as sender_type=user for sessions they created; agents must be authenticated, pass can_user_be_agent() or manage_options, and not supply sender_type from the client. Bind GET /messages and POST /end to that same ownership check. Do not trust client-supplied sender_type/sender_id.

• high Unauthenticated Google Calendar event creation and invite spam

  missing_auth

  POST /wp-json/ai-agent/v1/gcalendar/create-event is public (__return_true) whenever Google Calendar integration is enabled and connected. The handler forwards attacker-controlled title, description, start/end, attendee_email, attendee_name, and add_meet to Google Calendar events.insert with sendUpdates=all. There is no slot-availability check, rate limit, CAPTCHA, or session binding. Observable effects: arbitrary events on the site owner's calendar, Google Meet rooms created on demand (meet_link returned in the JSON), and calendar-invite emails sent from the connected Google account to any address — a phishing/spam channel that authenticates as the business. GET /gcalendar/slots is also public and hammers the freeBusy API.

  includes/class-rest-api.php:865-910

  Recommendation

  Bind booking to a chat session that already collected a verified email, allow only slots returned by get_available_slots(), rate-limit per IP/session, and do not accept arbitrary titles/attendees from unauthenticated clients. Consider a one-time booking token issued after /chat or /register-user.

• high Knowledge base JSON stored world-readable under uploads

  information_disclosure

  The RAG corpus is written to wp-content/uploads/ai-agent-knowledge/knowledge-base.json (KnowledgeBase::save). Activation only wp_mkdir_p() that directory; unlike ai-agent-files, no .htaccess/index.php deny rule is created. On typical Apache/nginx setups that serve uploads as static files, an unauthenticated GET of that well-known path returns the full document set, including text imported from Google Drive and Confluence (private wikis/docs the admin believed were server-side context for Groq). The public chat already answers questions from this corpus, but the raw JSON is a bulk dump with sources, not a Q&A filter.

  includes/class-knowledge-manager.php:32-34

  Recommendation

  Store the corpus outside the web root or add an Apache/nginx deny-all rule (mirror the .htaccess already used for ai-agent-files). Prefer a non-web-accessible directory or a randomized filename plus capability-gated download.

• medium Public WooCommerce product-by-ID endpoint leaks unpublished products

  information_disclosure

  GET /wp-json/ai-agent/v1/woocommerce/product/{id} is permission_callback __return_true whenever the WooCommerce integration is enabled. handle_woocommerce_product() calls wc_get_product($id) with no post_status or catalog-visibility check, then format_product_data($product, true), which includes description, SKU, weight, dimensions, categories, tags, and gallery URLs. Draft, private, pending, and catalog-hidden products that WooCommerce storefront/REST hide from guests are enumerable by sequential ID.

  includes/integrations/class-woocommerce-integration.php:381-393

  Recommendation

  Refuse products that are not published, not purchasable, or have catalog visibility hidden/search. Match WooCommerce's public product query (post_status=publish plus catalog visibility).

• medium Public register-user overwrites chat identity by email with no proof of ownership

  missing_auth

  POST /wp-json/ai-agent/v1/register-user is unauthenticated. If wp_aiagent_users already has that email, the handler UPDATE name, phone, and session_id for that row and returns the existing user_id. Anyone who knows or guesses a prior visitor's email can rename them, replace their phone, bind a new session, and have subsequent conversations/leads/Mailchimp/Zapier events attach to the victim's lead record. There is no magic-link or nonce proving control of the mailbox.

  includes/class-rest-api.php:1252-1267

  Recommendation

  Treat email match as a returning visitor only after verifying the mailbox, or create a new row keyed by session_id and leave the original PII immutable. Do not let an unauthenticated POST change name/phone on another user's row.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.