Endpoints\Token::exchange_token() performs no client authentication at all on the authorization_code grant — anyone holding a code and a client_id can redeem it, confidential clients included. This is the plugin's largest gap; PKCE (#1) only covers clients that opt in and is not a substitute for client authentication (RFC 6749 §4.1.3).
Client::get_type() returns 'public' or 'private' but nothing branches on it yet, and legacy/test data can have '' or other values — that needs normalizing before it can gate anything.
Mirrors upstream WP-API#36.
Endpoints\Token::exchange_token()performs no client authentication at all on theauthorization_codegrant — anyone holding a code and aclient_idcan redeem it, confidential clients included. This is the plugin's largest gap; PKCE (#1) only covers clients that opt in and is not a substitute for client authentication (RFC 6749 §4.1.3).Client::get_type()returns'public'or'private'but nothing branches on it yet, and legacy/test data can have''or other values — that needs normalizing before it can gate anything.Mirrors upstream WP-API#36.