High-severity findings.

Audited release

2.17.2

Findings

4

Worst severity

high

Content hash

f36b680952d04a4a5c3783f8… Copy

Findings

• high Unauthenticated REST endpoints leak captain and player emails and phones

  information_disclosure

  Several kkl/v1 GET routes are public because they omit a top-level permission_callback (WordPress then admits everyone) or nest permission_callback inside args, where it is treated as argument schema rather than a gate. GET /wp-json/kkl/v1/matches/{id}/info runs getFullMatchInfo, which SELECTs homecaptain.email and awaycaptain.email. GET /seasons/{id}/teams, /clubs/{id}/teams, and /clubs/{id}/currentteam attach getTeamProperties(), which adds captain_email and vice_captain_email. GET /players/{id} and /players/{id}/properties plus GET /teams/{id}/properties put authenticate_api_key under args, so they are also public and return players.email/phone and those same property emails. Locations::get_teams_for_location explicitly unsets captain_email/vice_captain_email, which shows the authors knew this data should not be public — but the other routes still expose it. Observable: unauthenticated JSON with captain emails/phones for every team/match, which is also the secret used by the fixture PATCH below.

  src/Api/Matches.php:58-66

  Recommendation

  Put permission_callback at the register_rest_route top level on every route. Do not return email/phone from public GETs (strip captain_email/vice_captain_email/home_email/away_email the same way Locations.php already does). Require authenticate_api_key (or current_user_can) for /players, /matches/{id}/info, team properties, and any embed that joins players.

• high Unauthenticated match fixture updates authenticated only by a known email address

  missing_auth

  PATCH /wp-json/kkl/v1/matches/{id}/fixture is registered for anonymous callers. permission_callback is_valid_email_for_match json_decodes the body and returns true if body.email matches a home/away captain, vice-captain, or ligaleitung player email — there is no login, nonce, magic-link, or proof of mailbox control. set_match_fixture then writes matches.fixture and optional matches.location and fires MATCH_FIXTURE_SET. Mail\EventListener::post_new_fixture wp_mail()s ligaleitung@kickerligakoeln.de and both captains; Slack\EventListener posts the actor email into #spielbetrieb. The public [set_match_fixture] shortcode posts exactly this JSON. Combined with the public /matches/{id}/info and /seasons/{id}/teams email leak, any visitor can change kickoff time/venue and trigger league email/Slack. Schedule shortcodes and widgets read those columns on the frontend.

  src/Api/Matches.php:37-46

  Recommendation

  Require a logged-in user (or a signed, single-use token emailed to the captain) plus a REST nonce. Do not treat a self-asserted email as authentication. Rate-limit fixture writes and confirm changes out-of-band.

• high Any logged-in user can create or delete REST API keys; keys are uniqid() and grant score writes

  missing_capability

  admin_post_kkl_create_api_key is hooked without a capability check or nonce. WordPress fires admin_post_{action} for every authenticated user, so a Subscriber POSTing to /wp-admin/admin-post.php with action=kkl_create_api_key&api_key_name=x inserts a kkl_api_keys row. The secret is uniqid('kkl_') (unix time + microseconds, no more_entropy). The handler redirects to the settings screen the subscriber cannot view, but the key space per second is ~2^20 and is brute-forceable against authenticate_api_key. delete[{api_key}]=1 deletes by that string. A valid X-Api-Key authorizes PATCH/PUT /matches/{id}/score (set_live_result / set_final_match_result, the latter sets status=3 and calculateScores so public ranking shortcodes change), POST /gamedays/{id}/match, season import/create, and GET /players, /admins, /mailinglists/league (plaintext captain emails). CSRF from a logged-in admin's browser can also mint or delete keys.

  src/Backend.php:387-415

  Recommendation

  Gate the handler with current_user_can('manage_options') and check_admin_referer. Generate keys with wp_generate_password / random_bytes, show the secret once, and store a hash. Do not accept delete keys from a Subscriber. Reject X-Api-Key until the creating admin has copied it.

• high Admin league CRUD saves without verifying the nonce that the form prints

  csrf

  scbAdminPage::form_wrap embeds a nonce in every form_table, and the parent form_handler calls check_admin_referer. KKL\Ligatool\Backend\AdminPage overrides form_handler and only tests $_POST['submit'], then save(). LeagueAdminPage, SeasonAdminPage, GameDayAdminPage, MatchAdminPage, ClubAdminPage, TeamAdminPage, PlayerAdminPage, and LocationAdminPage all inherit this. Those pages are registered with default capability manage_options (hidden parent=null submenus under admin.php?page=kkl_*_admin_page). A CSRF POST with submit=1 and the entity fields runs createOrUpdateMatch/Player/Club/… as the visiting administrator: match scores (frontend tables), player email/phone, club logos (wp_handle_upload). elevated is false because the screen itself is manage_options; the missing check is what makes a cross-site POST succeed.

  src/Backend/AdminPage.php:25-36

  Recommendation

  Call check_admin_referer($this->nonce) (or check_admin_referer of the page slug) at the start of form_handler before save(), matching scbAdminPage. Keep capability manage_options on page_init.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.