Plugin and Theme Update Proxy WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.07

Findings

3

Worst severity

high

Content hash

b75457c955c665b91e957bc3… Copy

Findings

• high Generated update-cache PHP interpolates unsanitized plugin/theme version and is include()d on a nopriv endpoint

  rce

  ajaxHostedEndpoint (wp_ajax_nopriv_ptup_hosted) builds downloadable cache files under WP_CONTENT_DIR/ptup-cache. createDownloadableFile() writes a PHP script via heredoc and interpolates $downloadedFileName raw into header('content-disposition: attachment; filename=$downloadedFileName'). Callers pass "{$baseName}.{$data->new_version}.zip" or the local plugin/theme Version header; $md5 and the zip body are addslashes()'d, and createDownloadableFileVersionCache() addslashes()s the same version, but the filename argument is not. ajaxDownloadPackageEndpoint (also nopriv) then include()s cacheDirectory/type/package after only a non-strict in_array() against the token's selectedPlugins/selectedThemes (sanitize_text_field does not strip ../). A crafted new_version from a custom/premium update API (this plugin's intended data source) or a crafted Version header, e.g. 1.0');phpinfo();//, becomes executable PHP when any holder of the hosting token requests ptup_hosted then ptup_download_package. Direct web hits on the generated files 404 unless WPINC is defined, so the include() is the execution trigger. mkdir(..., 0777, true) leaves that tree world-writable. Subscriber cannot mint a token; the token is a UUID. This is not Subscriber BAC, but it is RCE in the unauthenticated download path once version metadata is hostile.

  includes/common.class.php:47-98

  Recommendation

  Do not generate executable PHP for zip payloads. Store opaque .zip files outside the web root (or behind a deny-all .htaccess) and stream them with readfile() after a realpath() prefix check that the resolved path stays under the cache directory. If a PHP wrapper is kept, allow-list the filename to [A-Za-z0-9._-] and escape every interpolated value. Use mkdir 0750, hash_equals for token compare, and in_array(..., true). Never include() a request-derived path.

• medium Source and authentication-token AJAX have no nonce; POST overwrites the plugin-update supply chain

  csrf

  wp_ajax_ptup_sources and wp_ajax_ptup_authentication_tokens require current_user_can('manage_options') but never call check_ajax_referer or wp_verify_nonce. The React admin app POSTs application/json to admin-ajax.php with cookies and no nonce header (window.PTUP only localizes ajaxURL). POST ptup_sources json_decode()s php://input and update_option('plugin_and_theme_update_proxy_source') then immediately wp_remote_get()s the new updateURL (wp_remote_get, not wp_safe_remote_get; sslverify is skipped when skipSSLCertificateChecks is true). POST ptup_authentication_tokens writes the raw JSON body to plugin_and_theme_update_proxy_authentication_tokens with no schema check of selectedPlugins paths. Classic cross-site HTML form CSRF cannot send JSON that json_decode()s, so this is not a one-click third-party form; it is exploitable as same-site CSRF from any frontend XSS, a plugin admin XSS, or a multisite site admin who has manage_options but not install_plugins (the UI cap). Consumer: the next update check uses that source to populate update_plugins/update_themes package URLs (installable zips) and a planted token can zip-exfiltrate selected plugins via nopriv ptup_download_package. Subscriber cannot call these handlers.

  includes/base.class.php:731-870

  Recommendation

  Localize a capability-bound nonce (wp_create_nonce) with the admin app and check_ajax_referer() on every ptup_* admin AJAX action. Align the AJAX cap with the options page (install_plugins) or require both. Validate source updateURL with wp_http_validate_url / wp_safe_remote_get, force sslverify unless an explicit dangerous opt-in is stored server-side, and allow-list selectedPlugins/selectedThemes against get_plugins()/wp_get_themes() keys before saving.

• medium Client merges the entire remote update JSON into core transients, not only the selected plugin/theme

  unsafe_input

  pushUpdate() builds the outbound POST body as array_intersect_key($checked, selectedPlugins|selectedThemes), so the client only asks about the one item the admin selected (free version cap). On HTTP 200 it json_decode()s the body and array_merge()s every key under response and no_update into the pre_set_site_transient_update_plugins / update_themes value with no second intersect against the allow-list and no allow-list of package URL hosts. A compromised hosting site, a source URL pointed at an attacker (finding 2), or a MITM when skipSSLCertificateChecks is on can therefore inject a fake update (new_version + package zip URL) for WooCommerce, a security plugin, or any other installed slug. WordPress then shows that zip as an update; auto-updates or an admin 'Update' click installs it (RCE). This is the delta beyond 'the source is trusted for the one selected plugin' — the UI and request filter promise a single slug, the merge does not. Runs during cron/admin update checks, not as Subscriber.

  includes/base.class.php:186-256

  Recommendation

  After decoding the source JSON, drop any slug not in selectedPlugins/selectedThemes and not in the request $checked set. Validate each package URL (https, wp_http_validate_url). Do not merge unknown subkeys. Keep sslverify true by default; if an insecure opt-in exists, warn that it trusts the source for every installed plugin, not just the selected one.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.