Admin Coach Tours WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

0.6.0

Findings

4

Worst severity

high

Content hash

4df89dfcd60bd32f534a3c21… Copy

Findings

• high Subscriber can invoke site-wide AI tour generation with no rate limit

  missing_capability

  POST /wp-json/admin-coach-tours/v1/ai/generate-tour is gated by Routes::can_run_tours(), which only requires is_user_logged_in() and current_user_can('run_act_tours'). Capabilities::CAPABILITIES maps run_act_tours to the primitive `read`, and grant_capabilities copies that to every role that can read — including Subscriber and WooCommerce Customer. The sibling educator endpoint /ai/generate-draft correctly uses use_act_ai → manage_options, and the localized pupil script even sets canRun to current_user_can('edit_posts'), but neither is enforced on this route. When act_ai_enabled is on and a WP AI connector is configured (the documented production setup), AiController::generate_tour → TourGenerator::generate → AiManager::run_prompt calls wp_ai_client_prompt() with attacker-controlled query/taskId/locale/editorContext, using_max_tokens(4000), and the site's connector credentials. There is no per-user quota. Unique queries also write autoloaded transients named act_tour_{md5} for DAY_IN_SECONDS. A registered customer can therefore drain paid inference and bloat wp_options from wp-admin/profile.php (core supplies a wp_rest nonce) without ever opening the block editor.

  php/Rest/Routes.php:236-304

  Recommendation

  Gate /ai/generate-tour (and /ai/tasks) on use_act_ai or at least edit_posts — the same primitive the pupil UI already advertises — not read. Keep run_act_tours for read-only GET /tours if pupils must list published tours. Add per-user rate limiting before wp_ai_client_prompt, and do not cache attacker-controlled queries as unbounded transients.

• medium Non-public act_tour CPT is world-readable via core REST, including step JSON

  information_disclosure

  ToursCpt registers act_tour with public=false, publicly_queryable=false, but show_in_rest=true, rest_namespace=admin-coach-tours/v1, rest_base=act-tours, and capability_type=post. WP_REST_Posts_Controller::get_items_permissions_check returns true for context=view, and check_read_permission returns true for post_status=publish whenever show_in_rest is set — no current_user_can. `_act_steps` (and the other _act_* keys) are register_post_meta'd with show_in_rest; auth_callback only runs on add/update/delete_post_meta, so GET includes the full steps array (HTML instructions, CSS locators, insertBlock preconditions). Independently, the custom collection GET /admin-coach-tours/v1/tours uses can_run_tours (`read`) and defaults status to 'any', so any logged-in user can list drafts that the repository layer would otherwise treat as publish-only. The plugin's own pupil/educator clients were meant to be the only readers.

  php/Cpt/ToursCpt.php:94-211

  Recommendation

  Set show_in_rest false on the CPT and drive the editor UI through the plugin routes, or supply a custom REST controller whose permission_callback requires run_act_tours/edit_act_tours. Default the custom collection status to publish and hide drafts from users who cannot edit_act_tours. If meta must stay in REST, add a read-side auth_callback that rejects anonymous users.

• medium Tour CPT uses post capabilities, so Editors can delete admin-authored tours

  missing_capability

  The plugin defines a full custom capability map (edit_act_tour, edit_others_act_tours, …) and grant_capabilities only assigns those caps when the user has manage_options. map_meta_caps() also special-cases edit_act_tour/delete_act_tour/read_act_tour. None of that is wired into register_post_type: capability_type remains 'post' (create_posts=edit_posts, delete_others_posts=Editor). Core REST at /admin-coach-tours/v1/act-tours therefore lets Contributors create drafts, Authors publish, and Editors PATCH/DELETE any act_tour — including tours an administrator created through the locked-down custom /tours routes. Meta writes of `_act_steps` are still blocked by auth_callback, but title/status/trash are enough to unpublish or destroy the admin's catalog. show_ui=true and show_in_menu=false still leave post-new.php?post_type=act_tour and the REST API reachable.

  php/Cpt/ToursCpt.php:113-119

  Recommendation

  Register the CPT with capability_type array ('act_tour','act_tours') and map_meta_cap true (or an explicit capabilities array using the existing POST_TYPE_CAPS constants) so core REST and wp-admin honor edit_act_tours. Keep show_ui only for users with that cap.

• medium Tour step HTML is stored unsanitized and rendered with dangerouslySetInnerHTML

  xss_stored

  Educator PUT /admin-coach-tours/v1/tours/{id} (manage_options) accepts a steps array. StepSchema::validate checks types but does not kses HTML. TourRepository::save_steps then $wpdb->delete/$wpdb->inserts the raw JSON into postmeta specifically 'to bypass sanitize_callback issues' — skipping ToursCpt::sanitize_steps_json, which would have run wp_kses_post on instruction and sanitize_text_field on content. Pupils render step.content via React dangerouslySetInnerHTML in CoachPanel. Script tags will not run, but event-handler markup (img onerror, svg onload, iframe-less javascript URLs that kses would have stripped) executes in the block editor as the pupil (Contributor/Author/Editor). A malicious or XSS-compromised administrator can therefore run JS as every user who starts that tour. AI-generated tours are wp_kses_post'd in AiManager::validate_and_sanitize_tour and are not this path.

  php/Storage/TourRepository.php:320-362

  Recommendation

  Sanitize each step with ToursCpt::sanitize_step (wp_kses_post on HTML fields) before save_steps, or stop bypassing the meta sanitize_callback. On the client, do not use dangerouslySetInnerHTML; render text or pass the HTML through a sanitizer that strips event handlers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.