Starterpack Mods WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

high

Content hash

3eb4e049d58a293db44a7247… Copy

Findings

• high Unauthenticated REST theme write via permission_callback __return_true

  missing_permission_callback

  Theme::register_routes() registers WP_REST_Server::EDITABLE on /{namespace}/theme with permission_callback __return_true. The intended callback 'SUPT\StarterpackMods\check_designer_permissions' (current_user_can('spck_design'), granted on activation only to roles with edit_theme_options) is present only as a comment. api_init() runs on rest_api_init for the main site; default namespace is spckmods/v1 (filterable via spckmods_api_base_route_namespace). update_theme() assigns $config = $request->get_body() with no capability check, no nonce check, no json_decode/schema, and no size limit, then file_put_contents() to {wp_upload_dir.basedir}/spckmods/theme-{unix}.json and copy() to theme.json. rest_cookie_check_errors does not require a nonce for a logged-out request, so an unauthenticated POST/PUT/PATCH (no cookies) writes the file. Filename/extension are fixed (not a webshell path), and this plugin does not echo the JSON into frontend HTML, so blast radius is site-wide theme-config overwrite, public retrieval via GET /theme, direct download of the uploads file, and unbounded revision files. The Gutenberg sidebar that is supposed to own the write is hidden unless core.canUser('create','users') (administrators).

  lib/rest-api/theme.php:57-71, 158-177

  Recommendation

  Set the EDITABLE route's permission_callback to 'SUPT\StarterpackMods\check_designer_permissions' (the helper already in lib/roles-capabilities.php). Keep GET public only if the front end must read tokens anonymously; otherwise require the same capability for revisions. Reject non-JSON bodies, cap request size, stop creating unlimited revision files, and create the uploads directory with 0755 instead of 0777.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.