Gutenberg Object Plugin WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.5.0

Findings

2

Worst severity

high

Content hash

f6b712299ad66d60333d64b9… Copy

Findings

• high Unauthenticated REST POST overwrites Gutenberg block JSON for any post

  missing_permission_callback

  gutes_db_api_init() registers POST gutes-db/v1/(?P<id>\d+) with callback save_editor_data and no permission_callback. WordPress REST (WP_REST_Server::respond_to_request) only runs a permission check when permission_callback is non-empty, so an omitted callback is public: administrator, editor, author, subscriber, customer, and unauthenticated all reach the handler. save_editor_data() never calls current_user_can('edit_post') or verifies a nonce; it casts id to int, treats the post as eligible if is_gutes() (empty post_content or has_blocks), json_decodes gutes_data, and save_editor_db() INSERT/UPDATEs {prefix}gutes_arrays.gutes_array via $wpdb->prepare (quoted '%s' is stripped back to %s by wpdb::prepare, so the write succeeds). Observable: curl -X POST /wp-json/gutes-db/v1/1 -d 'gutes_data=[{...}]' overwrites the block object for post 1 if it is Gutenberg (or empty). Consumers of that row are GET /wp-json/gutes-db/v1/{id}, GET /wp-json/wp/v2/posts/{id}/blocks, register_rest_field editor_blocks on the public /wp/v2/posts/{id} response (Hooks::get_block_data), and get_editor_blocks(). wp_posts.post_content is not modified, so the classic PHP theme still shows the original post, but any headless or theme consumer of editor_blocks / get_editor_blocks() serves attacker-controlled block attributes (including HTML paragraph content). The editor script localizes a wp_rest nonce but the PHP callback does not read it; unauthenticated requests do not need one.

  src/API.php:65-110

  Recommendation

  Add permission_callback that returns current_user_can('edit_post', (int) $request['id']) on the POST route (REST cookie auth will then also require a valid X-WP-Nonce). Re-check edit_post inside save_editor_data. Do not accept writes for posts the user cannot edit. Consider show_in_index false for the save route.

• high Unauthenticated REST GET discloses unpublished Gutenberg data and post revisions

  information_disclosure

  GET gutes-db/v1/(?P<id>\d+) (get_editor_data) and GET gutes-db/v1/(?P<id>\d+)/revisions (get_revision_data) are registered without permission_callback, as are BlockAPI routes GET wp/v2/posts/(?P<id>\d+)/blocks and GET wp/v2/posts/(?P<id>\d+)/blocks/(?P<bid>\S+). get_editor_data() / get_all_blocks() load the post with get_post($id) and the custom table via get_editor_db(); is_gutes() only tests empty content or has_blocks() and never is_post_publicly_viewable() or current_user_can('read_post'). Core /wp/v2/posts hides drafts/private/password bodies from guests; these routes do not. Observable: unauthenticated GET /wp-json/gutes-db/v1/{id} (and GET /wp-json/wp/v2/posts/{id}/blocks) enumerates sequential IDs and returns gutes_array JSON for any draft, private, future, or password-protected Gutenberg post that was saved through this plugin. get_revision_data() calls wp_get_post_revisions($post_id) with no edit_post check and attaches parsed blocks; that dumps full revision WP_Post objects including post_content when function_exists('gutenberg_parse_blocks') (Gutenberg plugin / this plugin's original target). On current core-only WordPress, gutenberg_parse_blocks is absent so the revisions route returns WP_Error before the dump; the custom-table GET routes still leak. register_rest_field editor_blocks on 'post' is not this bug (it inherits core post REST read caps).

  src/API.php:38-63

  Recommendation

  Set permission_callback on every GET route to current_user_can('read_post', (int) $request['id']) (or is_post_publicly_viewable() for a public-read subset). For revisions, require current_user_can('edit_post', $post_id) to match core's revision controller. Apply the same read_post check in get_editor_data, get_all_blocks, and get_single_block before querying {prefix}gutes_arrays.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.