TouchPoint WP WP Registry grade D. High-severity findings · 6 findingsWP RegistryHigh-severity findings · 6 findingsOpen the reportD

High-severity findings.

Audited release

0.0.95

Findings

6

Worst severity

high

Content hash

fd251d831dd349ebf16e50f0… Copy

Findings

• high Unauthenticated ident creates or updates church people and returns family PII

  information_disclosure

  POST /touchpoint-api/person/ident has no capability or nonce. After an optional CleanTalk check (skipped if that plugin is absent), Person::ident() posts the JSON to TouchPoint. If firstName and lastName are present, WebApi.py calls model.FindAddPeopleId() (creates a person in the ChMS) and may UpdatePerson with attacker zip/phone/email. If only email+zip are sent, matching family members are returned (goesBy, last initial, familyId, peopleId) and stored for RSVP/join. If fid is supplied, PHP only unsets pid, so arbitrary family IDs are enumerated. Observable: unauthenticated POST {"firstName":"A","lastName":"B","email":"x@y.z","zip":"12345"} creates a TouchPoint person; POST {"fid":[1],"email":"a@b.c"} lists that family's people IDs for use in RSVP/join/auth token minting.

  src/TouchPoint-WP/Person.php:1580-1606,1760-1764

  Recommendation

  Rate-limit ident. Require a CAPTCHA or similar always, not only when CleanTalk is installed. Ignore client-supplied fid/pid. Do not call FindAddPeopleId from an unauthenticated WordPress request; look up existing people only and return the minimum fields. Bind subsequent RSVP/join to peopleIds actually returned into the server-side session.

• high Unauthenticated force-sync creates a persistent administrator and runs as that user

  missing_auth

  GET /touchpoint-api/person/force-sync, /inv/force-sync, /global/force-sync, and /report/force-sync (and report/sync) have no capability or nonce. Each calls setTpWpUserAsCurrent(), which validateThatTpWpUserExists(): if username touchpoint-wp is missing, wp_create_user('touchpoint-wp', random, 'tpwp@tenth.org') and set_role('administrator'). The remainder of the request then creates/updates/deletes WP users and posts as that administrator (wp_set_current_user, no auth cookie, but all in-request caps are admin). Cron also creates the account. Observable: unauthenticated GET /touchpoint-api/person/force-sync creates user touchpoint-wp with vendor email tpwp@tenth.org as administrator if it did not exist; password reset to that mailbox is a standing recovery path. The same request is a CPU/API DoS (Involvement sync sets memory_limit 512M and max_execution_time 300).

  src/TouchPoint-WP/TouchPointWP.php:2575-2636

  Recommendation

  Do not create an administrator from a public URL. If a service account is required, create it only in activation/migration under manage_options, use a site-local email, and grant only the caps needed for sync. Gate force-sync behind current_user_can('manage_options') plus a nonce (or a high-entropy cron secret). Never wp_set_current_user to an administrator on an unauthenticated request.

• high Unauthenticated RSVP and involvement join accept arbitrary TouchPoint people IDs

  missing_auth

  POST /touchpoint-api/mtg/rsvp and (when involvements are enabled) POST /touchpoint-api/inv/join have no capability, nonce, or session check that the people[] IDs were previously ident'd. ajaxSubmitRsvps() json_decodes php://input and apiPost('mtg_rsvp'); WebApi.py calls model.EditCommitment(mid, pid, 'Attending'|'Regrets') for every ID in responses.Yes/No. ajaxInvJoin() forwards invId and people[].peopleId to model.AddMemberToOrg / SetMemberType Prospect. Combined with ident (or sequential PeopleId guessing), an unauthenticated visitor can RSVP or join groups as any congregation member. README advertises email+zip RSVP, but the server does not enforce that binding.

  src/TouchPoint-WP/Meeting.php:612-730

  Recommendation

  On ident, store allowed peopleIds in a server-side session (start the session on the API request). Reject RSVP/join peopleIds that are not in that session. Cap invId to involvements actually published as WP posts. Add CSRF tokens to the JSON POSTs.

• high Web-accessible generateDocs.php downloads a PHAR and executes shell commands

  dev_tool_in_production

  generateDocs.php has no ABSPATH / CLI / capability guard. A default WordPress install serves plugin PHP over HTTP. Visiting /wp-content/plugins/touchpoint-wp/generateDocs.php file_put_contents a phpdoc.phar from phpdoc.org, exec()s php vendor binaries and that PHAR, rewrites docs/*.md, and exec()s git add/commit/push. Observable: unauthenticated GET of that URL performs remote file write into the plugin directory and process execution as the web user; if git credentials exist, it pushes. This is a shipped development tool, not a runtime feature.

  generateDocs.php:1-73

  Recommendation

  Delete generateDocs.php from release zips, or guard with `PHP_SAPI === 'cli'` and exit. Do not download or exec PHAR/binaries from a web-reachable file. Keep documentation generation in CI.

• medium Unauthenticated cleanup endpoint deletes extra-value user and post meta

  missing_auth

  GET/POST /touchpoint-api/cleanup has no capability or nonce and always runs Cleanup::cronCleanup(true). cleanupPersonEVs() / cleanupFamilyEVs() DELETE FROM usermeta/postmeta rows whose meta_key LIKE 'tp_pev_%' and is not in the configured extra-value allowlist. Observable: any visitor can trigger mass deletion of imported person extra values (bios and custom EVs) and partner family EVs, wiping public staff/partner fields until the next sync.

  src/TouchPoint-WP/Utilities/Cleanup.php:74-78,117-157

  Recommendation

  Remove the public API route. Keep cleanup on the existing cron hook only, or require manage_options plus a nonce.

• medium Admin API endpoints have capability checks but no nonce (phpinfo, debug, migrate, script zip)

  missing_nonce

  TouchPointWP_AdminAPI::api() gates scriptzip, script-update, debug-enable/disable, force-migrate, and phpinfo with currentUserIsAdmin() (manage_options) only. There is no wp_verify_nonce or referer check. A CSRF GET from an administrator's browser to /touchpoint-api/admin/phpinfo dumps phpinfo(); debug-enable sets option tp_DEBUG=true (verbose API URLs/errors); force-migrate reruns migrations; scriptzip downloads the Python package that is deployed with API privileges on TouchPoint. memtypes is not even admin-gated and proxies division IDs to the TouchPoint API.

  src/TouchPoint-WP/TouchPointWP_AdminAPI.php:42-104

  Recommendation

  Require check_admin_referer / wp_verify_nonce on every admin API action. Drop phpinfo() from production. Give memtypes the same admin+nonce gate. Prefer admin-ajax or REST with permission_callback.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.