Art Show ID WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.2.4

Findings

1

Worst severity

high

Content hash

8c94edc72fe658faed045534… Copy

Findings

• high Hardcoded GitHub personal access token shipped for auto-updates

  hardcoded_credentials

  updater_init() passes a base64 string to Updater::set_authorize(). get_repository_data() decodes it and sends Authorization: Bearer <classic ghp_ PAT> to GitHub's releases/latest API; the decoded value is a GitHub classic personal access token, not a fine-grained or installation token. Encoding hides the ghp_ prefix from GitHub push-protection/secret scanning, so the secret is likely still live despite sitting in a public repo and in every 1.2.4 zip. The repo is public, so a token is unnecessary for reads; any scope beyond anonymous public access (especially repo contents:write) lets an attacker mint a higher tag_name release. modify_transient() trusts that tag and browser_download_url with no signature check and injects it into update_plugins, so every install is offered that ZIP. download_package() is attached globally via upgrader_pre_download and, on the first download with a filename, overwrites request headers with Authorization: token {still-base64 secret}, leaking it to unrelated update hosts. after_install() then moves the extracted package into this plugin directory and activate_plugin()s it with no hook_extra plugin-slug check. Rotate/revoke the PAT immediately; removing it from a later tag does not invalidate copies already published.

  classes/Main.php:99-105

  Recommendation

  Revoke this PAT on GitHub immediately and purge it from git history and all release zips. For a public repository, call the GitHub releases API unauthenticated (or with a fine-grained token that is not distributed in the plugin). Do not base64- or otherwise obfuscate secrets. Scope any remaining token to contents:read on this repo only, and verify release assets (checksum/signature) before offering them as plugin updates. Limit upgrader_pre_download / upgrader_post_install / http_request_args to this plugin's package slug.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.