Critical findings.

Audited release

1.14

Findings

3

Worst severity

critical

Content hash

3fff7812c1376b4ba781b755… Copy

Findings

• critical Unauthenticated reflected XSS via url, time, and ref on the interstitial redirect page

  xss_reflected

  redirect-page.php is web-accessible (direct plugin path; Apache also gets an external rewrite to it). After it successfully boots WordPress it only checks that HTTP_REFERER contains home_url() as a substring, then prints a full HTML document. $_GET['url'] is concatenated with optional ?ref=$_GET['ref'] and echoed unescaped into var redir_url = "..."; inside a <script> tag; $_GET['time'] is echoed unescaped into a setTimeout numeric context. That is a script-tag sink (</script> breakout and JS-context injection), not innerHTML. wp_magic_quotes addslashes does not stop </script><script>… or 1);alert(1);//. The Referer gate is not auth: (1) the plugin's wp_footer handler intercepts every external <a> click and sends the victim here with a same-origin Referer, so a comment/author link with a crafted href becomes XSS when anyone clicks it; (2) the same file's bootstrap-failure 302 (see open-redirect finding) can bounce the browser to this URL so the second request carries a same-origin Referer; (3) strpos($referer, home_url()) matches https://victim.example.attacker.tld and https://attacker/?https://victim.example. Shortcode [rp_redirect_url] returns the same raw $_GET['url'] into the_content(). Base is not a secret — artvelog_redirect() prints base64(ABSPATH) on every public page. Observable: an unauthenticated visitor (or an admin who follows a crafted link) executes attacker JavaScript on the site origin.

  redirect-page.php:40-51, 94-116

  Recommendation

  Do not echo request parameters into HTML/JS. Pass the destination through wp_json_encode()/esc_js() and esc_url(), cast delay with absint(), and drop the [rp_redirect_url] raw echo. Replace the Referer substring check with a signed, short-lived token bound to the destination. Serve the interstitial through a normal theme template (index.php query var), not a standalone plugin PHP file.

• high Unauthenticated wp-blog-header.php include from a base64-decoded filesystem path; ABSPATH leaked in footer JS

  file_access

  redirect-page.php runs before WordPress. If $_GET['base'] is set it base64_decodes it, and if file_exists($path) it require_once $path.'/wp-blog-header.php' with no allowlist, realpath jail, or capability check. That is a direct wp-blog-header bootstrap with an attacker-chosen directory prefix (wrappers such as phar:// are also passed to file_exists, a known PHP object-injection primitive). The intended value is ABSPATH, but it is not a secret: index.php artvelog_redirect() does $site_directory = base64_encode(ABSPATH) and prints var base = "..." in wp_footer on every frontend page, so any visitor can copy a working base and hit /wp-content/plugins/artvelog-redirectpage/redirect-page.php?base=…. Filename is hardcoded to wp-blog-header.php so this is not arbitrary-file read of wp-config.php on a default install; it is still an unauthenticated local include of a user-controlled path and the loader that makes the XSS page possible. Observable: a GET with a leaked or guessed existing directory boots WordPress from that tree (or fatals/includes attacker PHP if that tree contains wp-blog-header.php).

  redirect-page.php:3-8

  Recommendation

  Delete the standalone bootstrap. Load the interstitial through a rewrite that stays inside index.php and uses ABSPATH from WordPress itself. Never accept a filesystem path from the query string, never print ABSPATH (even base64) to the browser, and do not pass user input to file_exists()/require.

• medium Unauthenticated open redirect when the WordPress bootstrap path is missing or invalid

  unsafe_input

  If $_GET['base'] is absent, or base64_decode(base) is not an existing path, redirect-page.php takes $_GET['url'] and, when filter_var(..., FILTER_VALIDATE_URL) succeeds, sends header('Location: '.$url) and exits. No Referer check, no nonce, no destination host allowlist, no interstitial. This runs before WordPress loads, so wp_safe_redirect is not used. Observable: GET /wp-content/plugins/artvelog-redirectpage/redirect-page.php?url=https://evil.example returns 302 Location: https://evil.example. That is distinct from the intended delayed JS redirect (which only runs after a successful bootstrap). The 302 also supplies a same-origin Referer for the reflected XSS on a follow-up request to the same file with a valid base.

  redirect-page.php:10-16, 24-30

  Recommendation

  Never 302 to a request-supplied URL. On bootstrap failure send the user to home_url() (wp_safe_redirect). If an interstitial destination is required, allowlist hosts or sign the URL and only navigate after the interstitial, never via an unauthenticated Location header.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.