Game-On WP Registry grade D. High-severity findings · 9 findingsWP RegistryHigh-severity findings · 9 findingsOpen the reportD

High-severity findings.

Audited release

3.3.6

Findings

9

Worst severity

high

Content hash

32eebe87aa51b294055816c7… Copy

Findings

• high Logged-in users can self-award arbitrary Game On points/currency via AJAX

  missing_capability

  go_admin_bar_add() only verifies a nonce (localized to every logged-in user via GO_EVERY_PAGE_DATA) and never checks manage_options or the go_bar_add_* / go_admin_bar_add_* option switches that gate the admin-bar UI. Any Subscriber can POST arbitrary point/currency/bonus/penalty/minute amounts to themselves, bypassing disabled UI and corrupting the gamification economy (and any badge/rank side effects).

  go_pnc.php:535-600

  Recommendation

  Require current_user_can('manage_options') for unrestricted admin adds, or for student self-adds enforce the corresponding go_bar_add_*_switch options server-side and optionally rate-limit amounts.

• high Logged-in users can self-award arbitrary Game On points/currency via AJAX

  missing_capability

  go_admin_bar_add() only verifies check_ajax_referer('go_admin_bar_add_' . $user_id) and never checks manage_options or the go_bar_add_* / go_admin_bar_add_* option switches that gate the admin-bar UI. GO_EVERY_PAGE_DATA localizes that nonce to every front-end visitor via go_enqueue_scripts_and_styles(). Any Subscriber can POST arbitrary point/currency/bonus/penalty/minute amounts to themselves, bypassing disabled UI and corrupting the gamification economy (and badge/rank side effects).

  go_pnc.php:535-600

  Recommendation

  Require current_user_can('manage_options') for unrestricted admin adds, or for student self-adds enforce the corresponding go_bar_add_*_switch options server-side and optionally rate-limit amounts.

• medium Unauthenticated go_buy_item short-circuits purchase gate when not logged in

  missing_auth

  wp_ajax_nopriv_go_buy_item is registered and go_buy_item() uses if ( ! $is_logged_in || ( enough_funds && within_limit ) ). When unauthenticated, the first clause is true so purchase side effects (go_add_post for uid 0, badges, receipt mail) run after only a uid-0 nonce check. Intended guest browse should not complete store transactions.

  types/store/includes/lightbox/buy-ajax.php:22-135

  Recommendation

  Require is_user_logged_in() before any purchase mutation; remove nopriv registration or return early for guests.

• medium go_search_for_user AJAX leaks display names without nonce or capability check

  information_disclosure

  go_search_for_user() is registered as wp_ajax_ but never calls check_ajax_referer despite the front-end sending a nonce, and has no capability gate. Any logged-in user can enumerate display names via LIKE queries.

  types/store/includes/lightbox/frontend-lightbox.php:559-581

  Recommendation

  Verify the AJAX nonce and restrict to logged-in store users; consider limiting search to users who opted into gifting.

• medium Unauthenticated go_buy_item short-circuits purchase gate when not logged in

  missing_auth

  wp_ajax_nopriv_go_buy_item is registered and go_buy_item() uses if ( ! $is_logged_in || ( enough_funds && within_limit ) ). When unauthenticated, the first clause is true so purchase side effects (go_add_post for uid 0, badges, receipt mail) run after only a uid-0 nonce check (localized via GO_BUY_ITEM_DATA for guests). Intended guest browse should not complete store transactions.

  types/store/includes/lightbox/buy-ajax.php:22-135

  Recommendation

  Require is_user_logged_in() before any purchase mutation; remove nopriv registration or return early for guests.

• medium Stats AJAX IDOR: any logged-in user can read another user's task/economy data

  information_disclosure

  go_admin_bar_stats accepts POST uid and go_stats_task_list / go_stats_item_list / go_stats_rewards_list / go_stats_minutes_list / go_stats_penalties_list accept POST user_id with only a shared nonce from GO_EVERY_PAGE_DATA. There is no check that the requester is the target user or has manage_options before returning avatar, login/display names, task progress, and serialized submission URLs. Classroom peer-view may be intended for scores, but task URL leakage and full progress dumps are oversharing.

  go_stats.php:8-16,134-152

  Recommendation

  Restrict non-admin callers to get_current_user_id() only; require manage_options (or an explicit peer-view capability) before returning another user's task URLs and detailed progress.

• medium go_search_for_user AJAX leaks display names without nonce or capability check

  information_disclosure

  go_search_for_user() is registered as wp_ajax_ but never calls check_ajax_referer despite the front-end sending a nonce, and has no capability gate. Any logged-in user can enumerate display names via LIKE queries for gift recipient search.

  types/store/includes/lightbox/frontend-lightbox.php:559-581

  Recommendation

  Verify the AJAX nonce and restrict to logged-in store users; consider limiting search to users who opted into gifting.

• low CMB oEmbed AJAX lacks capability check (nonce only)

  missing_capability

  cmb_oembed_ajax_results verifies ajax_nonce but not current_user_can. Bundled CMB admin helper; limited blast if nonce only appears on post edit screens.

  types/init.php:64-64

  Recommendation

  Add current_user_can('edit_posts') (or edit_post for the given post_id) alongside the nonce check.

• low CMB oEmbed AJAX lacks capability check (nonce only)

  missing_capability

  cmb_oembed_ajax_results verifies ajax_nonce but not current_user_can. Bundled CMB admin helper; limited blast if nonce only appears on post edit screens.

  types/init.php:64-64

  Recommendation

  Add current_user_can('edit_posts') (or edit_post for the given post_id) alongside the nonce check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.