High-severity findings.

Audited release

2.1

Findings

2

Worst severity

high

Content hash

5d25ea962c46e9f88c5f9ec6… Copy

Findings

• high CSRF to stored XSS in Aliyun CDN settings (unsanitized custom URLs and Access Key ID)

  xss_stored

  Settings::handle_submit() trims $_POST['custom_urls'] and $_POST['access_key_id'] into option alicdn_options with no sanitize_* and no escaping on output. view/settings.php prints Config::$custom_urls inside a <textarea> and Config::$accessKeyId inside an input value attribute with no esc_textarea/esc_attr (the plugin contains zero esc_* / sanitize_* calls). settings_page() always includes that view after a POST, so a CSRF body such as custom_urls=</textarea><script>…</script> is stored and executed in the same administrator response. The injected script runs with the victim's wp-admin privileges (plugin install, user-new, wp_rest nonce already on the page). On multisite, where site administrators lack unfiltered_html, this is also a stored-XSS primitive against other admins who open Settings → Alibaba Cloud CDN. Subscriber-or-equivalent cannot POST this themselves (menu cap administrator); the unauthenticated path is the missing nonce on the same handler.

  view/settings.php:31-58

  Recommendation

  Escape with esc_attr() on the Access Key ID value and esc_textarea() on custom_urls. On save, sanitize_text_field / sanitize_textarea_field (and keep secrets out of HTML). Pair with a verified nonce as in the CSRF finding so an unauthenticated page cannot plant the payload.

• medium Settings save has no nonce or capability check and overwrites Aliyun CDN credentials

  csrf

  add_options_page registers Settings::settings_page with capability 'administrator'. Any POST to that screen calls handle_submit(), which writes access_key_id, access_key_secret, refresh_type, and custom_urls into option alicdn_options. The form uses wp_nonce_url(Config::$settings_url) (default action -1) but handle_submit never calls wp_verify_nonce or check_admin_referer, and it has no current_user_can of its own. A cross-site POST from a page visited by a logged-in Administrator therefore replaces the site's Aliyun AccessKey pair and refresh policy. Empty access_key_secret is ignored, so an attacker can keep the existing secret while changing refresh_type or custom_urls. Consumers: Api::build_request uses the stored keys against cdn.aliyuncs.com; do_refresh uses refresh_type to choose ObjectPath (including whole-site Directory purge). REST refresh itself is not CSRF-able (permission_callback level_10 plus WP REST nonce header). Not Subscriber-reachable; blast is operator CSRF of CDN credentials and purge behavior.

  src/Settings.php:33-56

  Recommendation

  Call check_admin_referer() (and wp_nonce_field in the form, not only wp_nonce_url on the action) before writing options. Also require current_user_can('manage_options') inside handle_submit rather than relying solely on the menu capability string 'administrator'.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.