St. Paul's Admin WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

0.1.48-rc2

Findings

2

Worst severity

medium

Content hash

16f0280f2f076a255bcbd594… Copy

Findings

• medium Events admin POST updates events and deletes volunteer assignments with no nonce

  csrf

  spa_events_page() still handles a legacy POST of spa_event_name. The current Events UI saves via wp_ajax_spa_save_event_modal (spa_admin_nonce + manage_options), but this page-level branch remains live whenever an administrator loads admin.php?page=spa-events. It checks current_user_can('manage_options') only — no wp_verify_nonce / check_admin_referer. If event_id is present it $wpdb->update()s spa_events and then $wpdb->delete()s every spa_event_volunteers row for that event (wiping assignments) before redirecting. A cross-site POST is weakened by WordPress SameSite=Lax auth cookies, but any same-site CSRF (or a browser that still sends the cookie) as an administrator creates/alters public calendar events and drops that event's volunteer assignments. Subscriber cannot hit this path. Not RCE and fields are sanitize_text_field / sanitize_textarea_field.

  includes/events.php:618-650

  Recommendation

  Remove the leftover spa_event_name POST branch now that AJAX save is the UI, or add check_admin_referer() (and keep manage_options) before any update/delete. Do not delete spa_event_volunteers as a side effect of a name/date save.

• low spa_get_template_list_ajax verifies nonce but not capability

  missing_capability

  spa_get_template_list_ajax is wp_ajax_ only (logged-in). It check_ajax_referer('spa_admin_nonce') then SELECTs id, name, type from spa_notification_templates with no current_user_can. spa_admin_assets localizes spaAdmin.nonce on every spa-* admin page. The parent menu and spa-services submenu use edit_posts, so Contributor/Author/Editor who open Services receive that nonce and can POST action=spa_get_template_list. Sibling handlers spa_save_template / spa_delete_template / spa_load_template correctly require manage_options, so this is name/type disclosure only (not template HTML, not SMTP/Twilio secrets). Subscribers never get spa_admin_nonce: WordPress dies on spa-* pages they cannot access before admin_enqueue_scripts. Not a Subscriber BAC.

  includes/templates.php:7-21

  Recommendation

  Add current_user_can('manage_options') (same as spa_load_template_ajax / spa_save_template_ajax) immediately after the nonce check and 403 otherwise.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.