Frontend Post Order WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

medium

Content hash

a9512f809164cc05b7de7a2f… Copy

Findings

• medium Subscriber+ missing authorization on save_post_order allows arbitrary menu_order updates

  missing_capability

  fpo_save_post_order is registered only as wp_ajax_save_post_order (logged-in). It verifies nonce fpo_save_order_nonce then, with no current_user_can('edit_post') / edit_others_posts / manage_options check, walks a comma-separated $_POST['order'] list, integer-casts each id after stripping the 'post-' prefix, and calls wp_update_post() to set menu_order. wp_update_post does not enforce capabilities. fpo_enqueue_scripts runs on wp_enqueue_scripts for every frontend request (not gated on the shortcode or a role), so any Subscriber visiting any public page receives a usable nonce in fpo_ajax_object. The attacker does not need the shortcode UI: post IDs are enumerable via the REST API or HTML, and IDs of posts the user cannot edit (including other authors' posts, pages, products, and non-public types if the id is known) are accepted. Observable: those rows' menu_order change and any menu_order-sorted query (this plugin's shortcode, admin lists, page nav, Woo product order) reflects the new sequence. Unauthenticated users cannot hit the action. CSRF against another user is nonce-blocked; this is broken access control for the caller's own session.

  frontend-post-order.php:74-92,156-174

  Recommendation

  Before updating each post, load it and require current_user_can('edit_post', $post_id) (or a site-owner-configured capability such as edit_others_posts). Reject unknown/non-published IDs as appropriate. Restrict the AJAX payload to post types the request is allowed to sort. Enqueue the script and nonce only on singulars that contain [frontend_post_order], not on every frontend page. Keep the existing nonce check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.