High-severity findings.

Audited release

10.8.9

Findings

3

Worst severity

high

Content hash

c17ac4ee5ebdc320123b945b… Copy

Findings

• high REST get_userpage_tab IDOR: Subscriber can load another user's profile forms

  missing_capability

  Route tsjippy/v2/user_management/get_userpage_tab uses permission_callback current_user_can('read'). getUserPageTab takes user-id from request params. The $admin flag is only true when the caller has usermanagement/administrator roles; when a Subscriber requests another user-id, $admin is false but family/location/profile-picture/security still do new Forms(postId, userId: $userId) and return that form HTML. Observable: horizontal privilege escalation to read other users' profile form data.

  php/rest_api.php:107-180

  Recommendation

  If user-id != get_current_user_id(), require usermanagement/administrator (or edit_user) before rendering; otherwise force user-id to the current user.

• medium Unauthenticated REST endpoint mints wp_rest nonces

  missing_auth

  Same shared helper as Tsjippy Library: POST .../fetch_nonce with permission_callback __return_true returns wp_create_nonce('wp_rest') to anonymous callers, enabling nonce-only REST checks elsewhere to be satisfied without a session.

  shared-functionality/php/rest_api.php:25-35

  Recommendation

  Gate fetch_nonce behind is_user_logged_in() or delete the route.

• medium Unauthenticated REST /fetch_nonce mints wp_rest nonces

  missing_auth

  Shared helper POST tsjippy/v2/fetch_nonce with permission_callback __return_true returns wp_create_nonce('wp_rest') to anonymous callers, enabling nonce-only REST checks elsewhere to be satisfied as user 0.

  shared-functionality/php/rest_api.php:25-35

  Recommendation

  Remove public nonce minting or restrict to authenticated users; never authorize sensitive actions with wp_rest nonce alone.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.