WonderShield WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.6.1

Findings

2

Worst severity

medium

Content hash

54dcffe076be64cc8fa6fe46… Copy

Findings

• medium Spoofable client IP (CF-Connecting-IP / X-Forwarded-For) defeats lockouts and enables targeted IP blocking

  unsafe_input

  ws_get_ip() unconditionally prefers HTTP_CF_CONNECTING_IP, then HTTP_X_FORWARDED_FOR, over REMOTE_ADDR, with no trusted-proxy check. Every protection (failed-login threshold, wp-admin flood, path-probe auto-block, global block gate) keys on this value. An unauthenticated attacker can rotate the header to evade the brute-force lockout entirely, or set it to a victim's IP and trigger 5 failed logins or 3 probe paths to block that IP (30 minutes, repeatable), locking the administrator out of wp-login.php and the logged-out front end.

  includes/helpers.php:80-89

  Recommendation

  Use REMOTE_ADDR by default. Only honor CF-Connecting-IP/X-Forwarded-For when REMOTE_ADDR is in a configured trusted proxy list (e.g. Cloudflare ranges), and then take the right-most untrusted hop.

• low Block page leaks debug data (DB error, table counts, raw expiry) in an HTML comment

  debug_code

  ws_block_response() renders a 'ws-debug' HTML comment to blocked, unauthenticated visitors containing the plugin version, block-table row count, $wpdb->last_error and the global create-table error. This is leftover debug output that discloses internal state to attackers.

  templates/block-page.php:369

  Recommendation

  Remove the debug comment or gate it behind WP_DEBUG and a manage_options check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.