High-severity findings.

Audited release

1.1.5

Findings

1

Worst severity

high

Content hash

f020ec7ddc260cebda24db12… Copy

Findings

• high Vimeo API bearer token exposed to the browser on ACF input screens

  information_disclosure

  acf_field_vimeo_pro_data::input_admin_enqueue_scripts() (hooked by ACF on every input form: post/user/term editors and frontend acf_form()) calls getVimeoToken() → get_field('acf_vimeo_auth_token', 'options') and wp_localize_script's the raw bearer token as server_vars.vimeo_token. assets/js/input.js then sets request.setRequestHeader('Authorization', 'bearer ' + server_vars.vimeo_token) against api.vimeo.com/me/videos (search) and api.vimeo.com/videos/{id} with fields including files. The token is therefore in the HTML of any page that enqueues acf-input-vimeo_pro_data — view-source, XSS, or a copied admin page is enough to steal it. README instructs admins to create a Vimeo app token with Video Files plus Public/Private; that token can list the Pro account and return direct source URLs for private videos. There is no server-side proxy and no capability check on the localize. ACF field types register input_admin_enqueue_scripts globally, so the script is not limited to screens that actually contain this field. Reachability: administrator always (token is registered for that role). Editor/Author/Contributor: on ACF < 5.11 get_field still reads unregistered options_* rows, so they receive the token whenever they open an ACF input screen; on ACF 5.11+ the settings field group is only registered inside current_user_can('administrator'), so get_field returns null for those roles (search breaks — documented upstream) unless the site applies the common get_option('options_acf_vimeo_auth_token') workaround, which re-opens the leak. Unauthenticated: same as non-admin, plus any public acf_form that enqueues ACF input assets.

  fields/acf-vimeo_pro_data-v5.php:173-213

  Recommendation

  Never send the Vimeo access token to the browser. Proxy search and video-lookup through a privileged admin-ajax or REST endpoint that checks current_user_can (edit_posts or a dedicated cap) and a nonce, reads the token only in PHP, and returns a minimized JSON subset (no unrelated account data). Restrict the Vimeo token to the minimum scopes and rotate any token that may have been exposed.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.