Art Feedback Button WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.4.5

Findings

1

Worst severity

high

Content hash

03a3ecabecfa86e0319cf993… Copy

Findings

• high Unauthenticated mail send to arbitrary recipients via unsigned afb-emails

  unsafe_input

  POST /wp-json/afb/v1/form is registered with permission_callback __return_true and has no nonce, capability, captcha, or rate limit. Rest::form() takes the full request params, validates only the default name/email/phone fields, then Rest::send() builds $email_to from get_option('admin_email') unless afb-emails is present — in which case it base64_decodes the client value, splits on commas, trims, and passes the array to wp_mail() with no is_email() check and no server-side allowlist. The shortcode only base64_encodes its emails attribute into data-afb-emails / a hidden input (classes/class-shortcode.php, templates/form.php); that encoding is not a secret and is not HMAC-signed, so any unauthenticated client can mint recipients. Observable: POST application/x-www-form-urlencoded to /wp-json/afb/v1/form with afb-name=Test&afb-email=attacker@example.com&afb-phone=79999999999&afb-emails=dmljdGltQGV4YW1wbGUuY29t delivers the HTML callback mail to victim@example.com from info@{site host}. Comma-separated decoded lists send one message to many To: addresses. The sibling POST /afb/v1/window is also public but only reflects emails through esc_attr into the hidden field (not XSS).

  classes/class-rest.php:37-45,110-116

  Recommendation

  Do not trust client-supplied recipient lists. Keep destinations in a server-side allowlist (options or a signed token bound to the shortcode, e.g. wp_hash of the email list) and ignore afb-emails unless the signature matches. Validate every address with is_email(), cap the recipient count, and add rate limiting or a captcha on the public form. Default-only-to-admin_email is acceptable; arbitrary To: is not.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.