Talking Head WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.5.0

Findings

2

Worst severity

medium

Content hash

376b085e15a74e98a0965b07… Copy

Findings

• medium Job and manuscript REST routes lack per-episode authorization

  missing_capability

  Every talking-head/v1 jobs and manuscript route uses permission_callback fn() => current_user_can('edit_posts') and never checks current_user_can('edit_post', $episode_id) (or ownership of the job's episode). WordPress maps that cap to Contributor and above, while the episode CPT uses default capability_type 'post', so Contributors cannot edit other users' drafts via /wp/v2/th-episodes. The custom routes ignore that. Observable effects for a Contributor with a REST nonce: (1) GET /talking-head/v1/episodes/{id}/manuscript returns the canonical manuscript (full unpublished dialogue) for any talking_head_episode ID; (2) POST /episodes/{id}/manuscript/validate rebuilds and update_post_meta's _th_manuscript and _th_episode_status=ready on that post; (3) POST /jobs with another author's episodeId calls JobScheduler::schedule, which writes generating status, inserts a wp_th_jobs row, and enqueues talking_head_process_job — burning the site-wide WordPress AI connector and potentially overwriting _th_audio_url; (4) GET/cancel/retry /jobs/{id} operates on any job, including canceling in-flight generation (virtual-mode public players hide audio while status is generating). Subscriber and unauthenticated callers are blocked. HeadMetaBox correctly uses edit_post, which makes the REST gap inconsistent rather than by-design collaboration.

  src/REST/JobController.php:25-122

  Recommendation

  Change permission_callback to require current_user_can('edit_post', $episode_id) after resolving the episode (for /jobs POST and manuscript routes). For /jobs/{id} GET/cancel/retry, load the job, then require edit_post on job['episode_id']. Return 403 when the caller cannot edit that episode. Optionally restrict job creation to publish_posts if TTS spend should be editor-only.

• medium Public player REST discloses password-protected episode transcripts and audio URLs

  information_disclosure

  GET /talking-head/v1/episodes/{id}/player is registered with permission_callback __return_true. get_player_data only 404s when the post is missing, not talking_head_episode, or post_status !== 'publish'. Password-protected posts remain status=publish with post_password set; there is no post_password_required() or current_user_can('read_post') gate. An unauthenticated client that can enumerate sequential episode IDs receives JSON with title, audioUrl (_th_audio_url), duration, stitchingMode, and a transcript built from _th_manuscript segments (headName + text). Core /wp/v2/th-episodes would hide rendered content behind the password; this custom route is a side channel. The same publish-only check is the only confidentiality control — drafts and private posts are correctly excluded. Audio files under wp-content/uploads/talking-head/ are also directly fetchable (inherent to HTML5 audio), but the REST body additionally leaks the transcript text without the wp-postpass cookie.

  src/REST/PlayerController.php:25-70

  Recommendation

  After loading the episode, require current_user_can('read_post', $episode_id) or reject when post_password_required($post). For password-protected episodes, return 401/403 unless the request presents a valid post-password cookie. Keep __return_true only for truly public, non-password published episodes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.