[QIT] Warning in class-wc-rest-user-exists-controller.php

[ricardo]

Context: p1687217595824019/1687217105.664229-slack-CGGCLBN58

Message

register_rest_route() with permission_callback => __return_true

Source

audit.php.wp.security.rest-route.permission-callback.return-true

File

includes/admin/class-wc-rest-user-exists-controller.php:36

cc @malithsen

[zmaglica]

This issue impacts QIT, so assigning to Harmony (based on team responsibilities) @deepakpathania . Assigning as part of Gamma Triage process PcreKM-yM-p2.

[deepakpathania]

Errors surfaced by the QIT report should go to relevant teams who own that part of the codebase. @zmaglica

[malithsen]

Sorry, I missed the initial ping. To add some context, the endpoint defined in the file was initially removed in #6174. However, class-wc-rest-user-exists-controller.php file was brought back in #6303 to resolve an error that happens during the plugin upgrade. This file only exists to get around the upgrade error, and the API endpoint in the file is not registered or available anymore.

We have #6304 to address the root issue, after which class-wc-rest-user-exists-controller.php could be removed.

[vbelolapotkov]

To add some context, the endpoint defined in the file was initially removed in #6174

Based on this routing this issue to you @c-shultz for further prioritization. FWIW, I think it's blocked by #7464 #7465 and probably by #7147 , so adding blocked label as well.