High-severity findings.

Audited release

1.2.15

Findings

1

Worst severity

high

Content hash

080381c710583cdc101341c3… Copy

Findings

• high Unauthenticated dump of all post meta via REST and AJAX

  information_disclosure

  register_rest_route('wrp', 'postmeta/(?P<id>\d+)') has no permission_callback, so WordPress treats GET /wp-json/wrp/postmeta/{id} as public. The callback uses get_post_status($id) as an existence check (truthy for draft/private/trash/wc-completed/etc.) then returns get_post_meta($id) including protected keys. That bypasses core REST protected-meta rules and exposes WooCommerce order PII (_billing_email, _billing_phone, addresses), _order_key (order-received/pay URLs), payment-method meta, and product internals. A parallel nopriv AJAX action addon_handle_get_post_meta returns the same data after a nonce that GET /wp-json/wrp/ajaxnonce freely issues.

  inc/utils/class/class-api.php:18-47

  Recommendation

  Add a permission_callback that requires current_user_can('edit_post', $post_id) or a tighter capability. Do not return protected (underscore) meta to unauthenticated clients. Remove or similarly lock down addon_handle_get_post_meta and the public /wrp/ajaxnonce mill.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.