Tsjippy Library WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

10.8.3

Findings

4

Worst severity

high

Content hash

b0c93e4f225a484643cd2fed… Copy

Findings

• high REST /add_book allows any logged-in user with read to publish books

  missing_capability

  register_rest_route for tsjippy/v2/library/add_book uses permission_callback current_user_can('read'). Subscribers have 'read'. Callback Library::createBook inserts a 'book' post with post_status publish from POST title/description/author. Observable: Subscriber publishes arbitrary catalog entries on the front-end library.

  php/rest_api.php:17-48

  Recommendation

  Require a book-management capability (e.g. edit_posts or a custom manage_library) in permission_callback; do not treat 'read' as authorization for wp_insert_post publish.

• high AJAX tsjippy-process-library-upload lacks nonce and capability checks

  missing_capability

  wp_ajax_tsjippy-process-library-upload (no nopriv) calls ajaxUploadFiles which only checks !empty($_FILES['files']) then Library::processImage. No check_ajax_referer and no current_user_can. Any authenticated role including Subscriber can upload images for AI processing and receive HTML results. Contrast shared fileupload module which does verifyNonce.

  php/main.php:25-60

  Recommendation

  Add check_ajax_referer and a capability check (edit_posts or manage_library) before processing uploads; reject unauthorized callers with wp_send_json_error.

• medium Unauthenticated REST endpoint mints wp_rest nonces

  missing_auth

  POST .../fetch_nonce is registered with permission_callback __return_true and returns wp_create_nonce('wp_rest') to anonymous callers. That nonce satisfies handlers that only call wp_verify_nonce(..., 'wp_rest') without a capability check, amplifying CSRF/BAC against other plugins or routes on the same site.

  shared-functionality/php/rest_api.php:25-35

  Recommendation

  Require is_user_logged_in() (or remove the endpoint). Clients already receive a cookie-bound nonce via wp_localize_script when authenticated.

• medium Unauthenticated REST /fetch_nonce mints wp_rest nonces

  missing_auth

  POST tsjippy/v2/fetch_nonce is registered with permission_callback __return_true and returns wp_create_nonce('wp_rest') to anonymous callers. That nonce satisfies handlers that only call wp_verify_nonce(..., 'wp_rest') without also requiring a logged-in privileged user (including other plugins' flawed checks).

  shared-functionality/php/rest_api.php:25-35

  Recommendation

  Remove the public nonce minting endpoint, or restrict it to logged-in users and never treat a wp_rest nonce alone as authorization for state changes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.