High-severity findings.

Audited release

10.7.7

Findings

4

Worst severity

high

Content hash

10b47cbf072643b322168d0c… Copy

Findings

• high Unauthenticated mark_as_read / mark_all_as_read forges user compliance state

  missing_auth

  REST routes /mandatory_content/mark_as_read and /mark_all_as_read use permission_callback __return_true. Callers supply user-id (and post-id); handlers call add_user_meta($userId,'tsjippy_read_pages',...) with no proof the caller is that user. An unauthenticated attacker can mark any user's mandatory pages (or all audience pages) as read, defeating compliance gates.

  php/rest-api.php:44-96,182-212

  Recommendation

  Require the authenticated user to match user-id (or manage_options). For email links, use a signed, single-use token bound to user+post instead of bare email.

• high Public mark_as_read_public accepts bare email without signed token

  missing_auth

  GET /mandatory_content/mark_as_read_public takes post-id and email, looks up the user by email (or tsjippy_email meta), and adds tsjippy_read_pages without a HMAC/token. Anyone who knows a victim email can forge their read acknowledgement.

  php/rest-api.php:21-41,143-176

  Recommendation

  Include a keyed hash (user_id|post_id|exp) in the Mailchimp link and verify it server-side before writing meta.

• high Unauthenticated mark_as_read / mark_all_as_read forges user compliance state

  missing_auth

  REST routes mark_as_read and mark_all_as_read use permission_callback __return_true and accept an arbitrary numeric user-id. Callbacks call markAsRead()/markAllAsRead() which add_user_meta($userId, 'tsjippy_read_pages', ...). An unauthenticated attacker can mark every mandatory page as read for any user, defeating the plugin's purpose.

  php/rest-api.php:44-96,182-210

  Recommendation

  Require the requester to be the target user (or manage_options) and a valid nonce; never accept raw user-id from untrusted input.

• high Public mark_as_read_public accepts bare email without signed token

  auth_bypass

  GET mark_as_read_public takes email and post-id with __return_true. markAsReadFromEmail resolves the user by email (or tsjippy_email meta) and adds the read meta, then redirects. Anyone who knows a user's email can forge acknowledgements without opening the Mailchimp-signed intent. Mailchimp templates embed *|EMAIL|* but the endpoint does not verify a HMAC/expiry.

  php/rest-api.php:22-40,143-176

  Recommendation

  Use a signed, time-limited token (HMAC of user_id+post_id+expiry) in the email link instead of a bare email query parameter.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.