High-severity findings.

Audited release

1.3.1

Findings

4

Worst severity

high

Content hash

445562acbb8e3e9770bc5b73… Copy

Findings

• high Paid knowledge-base content readable via REST (and embed/search) without Access::can_access

  auth_bypass

  pd_doc is registered public, publicly_queryable, exclude_from_search false, and show_in_rest true with WP_REST_Posts_Controller. Core get_items_permissions_check() returns true for unauthenticated callers, and check_read_permission() allows any published post. Access::can_access() — the only paywall (need_access meta + ph_access_itemmeta expire_date) — is invoked solely in inc/templates/single-pd_doc.php after the single_template override. It is not hooked to rest_prepare_pd_doc, rest_pd_doc_query, template_redirect, the_content, or embed_template. An unauthenticated client can GET /wp-json/wp/v2/pd_doc?per_page=100 and /wp-json/wp/v2/pd_doc/{id} and receive content.rendered of paid chapters, defeating WooCommerce purchase grants. Additional leak paths: oEmbed /embed/ (does not use single_template), and the main WP search/?s= (exclude_from_search is false) which can surface excerpts. Observable: full paid HTML in the REST JSON body without a cookie or order.

  inc/classes/Domains/Doc/CPT.php:74-102

  Recommendation

  Enforce Access::can_access in a template_redirect (and embed) handler so theme overrides cannot skip it. Filter rest_prepare_pd_doc / rest_pd_doc_query to hide or 403 unpaid items for users who fail can_access (strip content.rendered/raw, excerpt, and passwordless embeds). Set exclude_from_search true for locked KBs or exclude unauthorized IDs in pre_get_posts. Consider a non-public CPT plus a custom rewrite if documents should never be in core REST.

• high Unauthenticated reflected XSS via knowledge-base ?search= parameter

  xss_reflected

  single-pd_doc.php reads $_GET['search'] and, when set, loads the doc-search template. That template printf()s the raw search string into an H6 and later builds new RegExp(`(${keyword})`) from the same URL param, then jQuery.replaceWith()s HTML containing the capture. There is no esc_html/esc_js. need_access defaults to 'no', so any public knowledge-base URL is an unauthenticated XSS sink (e.g. /{kb}/?search=<script>alert(document.cookie)</script>). On a paid KB the same payload executes for any customer or administrator who opens a crafted link (session/nonce theft). Parser-inserted script in the H6 runs; the highlight path additionally executes event-handler HTML via replaceWith. No nonce or capability is involved.

  inc/templates/pages/doc-search/index.php:14-15,40-46,71-94

  Recommendation

  Escape the heading with esc_html($search). Pass the keyword to JS via wp_json_encode / data-attribute and highlight with text nodes (or CSS) rather than RegExp+replaceWith HTML. Reject or sanitize regex metacharacters if highlighting stays in JS.

• high SQL injection in GET /wp-json/power-docs/users (shop_manager+)

  sql_injection

  Domains\User\Api registers GET users with permission_callback null; ApiBase therefore requires manage_options or manage_woocommerce (shop_manager). get_users_callback() takes REST query params that WP_REST_Server already wp_unslashed, sanitize_text_field_deep()s them (quotes survive), then interpolates them into SQL: LIKE '{$search}' on login/email/nicename/display_name; quoted granted_docs IDs; unquoted um.meta_key / um.meta_value; and ORDER BY u.{$orderby} {$order}. The assembled string is passed through $wpdb->prepare() with no placeholders and then wp_unslash() before get_col(). A shop_manager with a wp_rest nonce can time-blind or UNION-extract wp_users.user_pass, emails, and grant rows (e.g. ?meta_key=1%20OR%20SLEEP(5) or s=' OR SLEEP(5)--). That is privilege escalation from store manager to full database read. Subscriber/customer cannot call the route.

  inc/classes/Domains/User/Api.php:37-105

  Recommendation

  Use $wpdb->prepare() with %s/%d placeholders for every request value; never wp_unslash the SQL. Quote and whitelist orderby (ID, user_login, user_email, user_registered) and order (ASC|DESC). Cast granted_docs and pagination with absint. Keep the manage_options/manage_woocommerce gate (or tighten to manage_options only).

• high Bunny Stream API key localized on every wp-admin page, including Subscriber

  information_disclosure

  Bootstrap::admin_enqueue_script() hooks admin_enqueue_scripts with no $hook or capability check and always calls enqueue_script(). That function puts SettingsDTO Bunny Stream credentials (BUNNY_STREAM_API_KEY, BUNNY_LIBRARY_ID, BUNNY_CDN_HOSTNAME) plus a wp_rest nonce into PowerhouseUtils::simple_encrypt() and wp_localize_script()s the ciphertext as power_docs_data.env. simple_encrypt is reversible client-side (JSON → base64 → Caesar +1 per byte); the React bundle must decrypt it to use Bunny. Subscribers and WooCommerce customers can load /wp-admin/profile.php, receive the script, reverse the cipher, and call video.bunnycdn.com with AccessKey to list/delete/upload videos in the site's library. The key is a Powerhouse setting, but this plugin is what copies it onto every admin response.

  inc/classes/Bootstrap.php:28-95

  Recommendation

  Enqueue the admin SPA and localize env only on the Power Docs page (and only for manage_options). Never send Bunny Stream API keys to the browser; proxy uploads through an authenticated admin-ajax/REST route. If a client token is required, use a scoped, short-lived Bunny token rather than the library AccessKey.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.