High-severity findings.

Audited release

6.9.251

Findings

5

Worst severity

high

Content hash

fa913f7eefa659476648c4e1… Copy

Findings

• high Unauthenticated REST leaks invitee history, session notes, and meeting records

  information_disclosure

  GET /wp-json/calendly-bookings/v1/scheduled-events/invitee-history/{invitee} and GET /scheduled-events/view/{uuid} use permission_callback __return_true. get_invitee_history looks up invitees by name (underscores become spaces) and returns event uuid, name, start_time, location, status, and se.notes (admin/clinical notes JSON). get_event returns order_id, cancel_url, reschedule_url, event_payload, notes, invitee_name, and invitee_payload. Names are the same identifier the admin UI puts in data-invitee (spaces → underscores), so a known client name is enough; UUIDs also appear on My Account cancel/reschedule links and in emails. Admin JS consumes both endpoints with $container.html(), so the leak is the intended data shape. Locations listing is also public.

  includes/modules/class-cb-admin-rest.php:26-70,118-131

  Recommendation

  Gate both routes on manage_options (or require the current user to own the invitee email). Do not return admin notes, payloads, or cancel/reschedule URLs to unauthenticated callers.

• high Public meeting-scheduled page rebinds order_id and forces a Calendly sync

  missing_auth

  On activation the plugin publishes a page with slug meeting-scheduled. template_redirect, for any visitor, if is_page('meeting-scheduled') and GET event_start_time plus answer_1 are present: instantiates CB_API and calls sync_scheduled_events() (authenticated Calendly traffic, quota/DoS), then $wpdb->update wp_cb_scheduled_events SET order_id = intval(answer_1) WHERE start_time = converted event_start_time. No capability, nonce, or order-key check. An unauthenticated caller who knows or brute-forces a start_time (availability is public) can attach an arbitrary WooCommerce order number to that booking or hammer sync. Empty params 404 for non-admins, but populated params take the write path for everyone. The later template (meeting-scheduled.php) currently 404s non-admins because $uuid is unset, so this is a state-change/DoS bug rather than a Zoom-password IDOR on the default template.

  includes/utils/functions.php:41-74

  Recommendation

  Do not mutate bookings or trigger API sync from a public GET. Verify the visitor owns the order (login or WooCommerce order key) and that the start_time matches that order's meeting meta. Move sync to cron/admin.

• high Unauthenticated debug-token.php bootstraps WordPress and exposes license material

  dev_tool_in_production

  Plugin-root debug-token.php is web-reachable, has no capability or constant guard, and require_once '../../../wp-load.php' before any auth. It prints whether LICENSE_SECRET is defined and its length, the first 8 characters of options cb_license_key and cb_github_token, POSTs the stored license to the Cloudflare worker endpoint, and prints the worker HTTP status plus the first 200 bytes of the body. That is a production debug script plus information disclosure of update-license secrets.

  debug-token.php:1-66

  Recommendation

  Delete debug-token.php from distributed releases, or die unless WP_DEBUG and current_user_can('manage_options'). Never print license/token fragments or call the worker from an unauthenticated script.

• high Stored XSS in wp-admin via unsanitized event notes written by customers

  xss_stored

  calendly_bookings_update_scheduled_event and calendly_bookings_add_admin_notes are reachable by Subscriber (no cap/nonce). update_event() writes the notes column without sanitizing string values (JSON notes are stored as-is). Admin scheduled-events UI fetches /scheduled-events/view/{uuid} and invitee-history and assigns the notes.discussed/guidance/follow_up/admin fields into HTML via jQuery .html() in cb-admin-scheduled-events.js. A customer who sets notes to a JSON object with an <img onerror=...> or other event-handler payload executes script in an administrator browser when they click View/History, which is enough to create an admin user or change options. Consumer is innerHTML (event handlers fire; raw <script> tags via innerHTML do not).

  includes/modules/class-cb-scheduled-events.php:277-298

  Recommendation

  Sanitize/encode notes on write (wp_kses or json_encode of sanitized scalars). In admin JS, insert text with .text() or escaped templates, not .html(). Close the AJAX capability hole so only admins can write notes.

• medium Unauthenticated email-existence oracle

  information_disclosure

  POST /wp-json/calendly-bookings/v1/check-user-email uses permission_callback __return_true and returns {exists: true|false} for any sanitized email via get_user_by('email'). That is an unauthenticated, unthrottled user-enumeration oracle useful for credential stuffing against WooCommerce customer accounts.

  includes/modules/class-cb-frontend-rest.php:22-48

  Recommendation

  Do not confirm account existence to anonymous callers. If login-gating is required, always prompt for login and rate-limit, returning a generic response.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.