QL Events WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ #7 in Integrations & APIs

High-severity findings.

Audited release

0.3.2

Findings

2

Worst severity

high

Content hash

3e8744a75c3d4706f1499bdd… Copy

Findings

• high Unauthenticated GraphQL disclosure of draft, private, and password-protected events, venues, and organizers

  information_disclosure

  Core_Schema_Filters::is_cpt_private is hooked to graphql_data_is_private and, for tribe_events, tribe_venue, and tribe_organizer, always returns false. WPGraphQL's Post model treats non-publish and password-protected posts as private unless this filter says otherwise; returning false forces visibility=public and populates title, content, and all registered meta fields for any requester, including uid 0. The events connection defaults to post_status=publish, which still includes password-protected published events, so a public { events { nodes { title content } } } query returns the full body of members-only events without the password. Direct event(id:, idType: DATABASE_ID) / venue / organizer / contentNode lookups additionally return draft, private, and trash posts by sequential ID. Organizer.email and Event.virtualUrl (when Events Virtual support is on) are included. This is the same class of bug as TEC REST password-protected disclosure (CVE-2024-5333), on the public /graphql endpoint. Published non-password events were already public and are not the issue.

  includes/class-core-schema-filters.php:38-137

  Recommendation

  Honor WPGraphQL's default privacy. Only return false for published, non-password-protected posts the current user can read (empty post_password and public post_status, or current_user_can('read_post', $data->ID)). Do not override drafts, private, trash, or password-protected nodes to public.

• high Event.virtualUrl leaks ticket-holder-only meeting URLs to unauthenticated GraphQL clients

  information_disclosure

  When QL Events' Events Virtual setting is enabled, Event_Type::register_virtual_fields exposes virtualUrl by returning tribe_get_event($id)->virtual_url with no audience check. Events Virtual stores the raw Zoom/Meet/video URL on that property and separately computes virtual_should_show_embed / applies tribe_events_virtual_show_virtual_content, which hides the URL from anyone who is not in virtual_show_embed_to (all, logged-in, rsvp, or ticket). The GraphQL schema registers virtualShowEmbedTo and virtualShouldShowEmbed as informational fields but still always returns virtualUrl. An unauthenticated client can query a published event's virtualUrl and join a paid/RSVP-gated meeting. Combined with the graphql_data_is_private override, the same field also leaks meeting URLs on password-protected and draft virtual events. The field is only registered when enable_events_virtual_support is on and Events Virtual is active.

  includes/types/object/class-event-type.php:307-318

  Recommendation

  Return virtualUrl only when Events Virtual would show it on the front end (e.g. tribe_events_virtual_show_virtual_content / $event->virtual_should_show_embed is true for the current user). Otherwise return null. Keep virtualShowEmbedTo as a non-sensitive setting field.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.