WP Agenda Automatizada WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

4.0.0

Findings

3

Worst severity

high

Content hash

20aaa6e707d0bb5f4c15e4d6… Copy

Findings

• high Unauthenticated confirmation mailer leaks virtual meeting links to attacker-chosen email

  missing_auth

  wp_ajax_nopriv_aa_enviar_confirmacion is reachable by anyone who can obtain the public aa_reservation_nonce from the booking UI. After a nonce check and IP rate limit, the handler accepts attacker-controlled id_reserva, correo, nombre (and related fields) and delegates to confirm_backend_service_enviar_correo. That service looks up aa_reservas by id_reserva, pulls virtual_link and join_token, builds join_url=home_url('/citas-virtuales/?token='+join_token), and POSTs backend_data including email=$datos['correo'] (attacker-chosen) to the confirmation mail API. An unauthenticated attacker can enumerate reservation IDs and receive confirmation emails containing virtual meeting links / join tokens for other customers' appointments, and can also spam arbitrary inboxes via the site's mail pipeline.

  includes/controllers/confirmController.php:65-121

  Recommendation

  Require proof of ownership (e.g. match correo/telefono to the reservation row, or a per-reservation secret issued at booking time) before sending. Always send only to the email stored on the reservation, never to a client-supplied address. Prefer removing nopriv access for this mail trigger or binding it to the just-created reservation response token.

• high Confirmation mail service attaches reservation join_token to attacker-supplied recipient

  information_disclosure

  confirm_backend_service_enviar_correo uses intval($datos['id_reserva']) to SELECT virtual_link and join_token from aa_reservas, constructs join_url for virtual attendance, and places attacker-controlled $datos['correo'] into backend_data['email'] without verifying that the address belongs to that reservation. Combined with the nopriv AJAX controller, this is the concrete sink that discloses meeting access tokens.

  includes/services/confirm-backend-service.php:720-812

  Recommendation

  Load the recipient email exclusively from the reservation/cliente record. Do not accept client-supplied correo for this path. Consider omitting join_token from any channel that is not the verified booker.

• medium State-changing assignment/staff AJAX lacks CSRF nonces

  csrf

  Multiple manage_options AJAX handlers that create/update/delete staff, service areas, services, and assignments (e.g. aa_create_staff, aa_create_assignment, aa_delete_assignment, aa_toggle_staff) check current_user_can('manage_options') but never call check_ajax_referer/wp_verify_nonce. An attacker who can trick a logged-in administrator into visiting a crafted page can forge POSTs to admin-ajax.php and mutate scheduling configuration.

  includes/services/assignments/staffService.php:60-90

  Recommendation

  Add check_ajax_referer (shared aa_* nonce) to every state-changing assignment/staff/area/service AJAX handler before processing POST bodies.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.