EDD Software Licensing Releases WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.0

Findings

3

Worst severity

high

Content hash

424e1869e923ffcc819511e7… Copy

Findings

• high Product managers can exfiltrate the configured GitHub token through an arbitrary asset URL

  ssrf

  The create-release REST endpoint accepts git_asset_url after only esc_url_raw validation. Any user with edit_products can point it to an attacker-controlled public HTTPS endpoint; GitHubApi::makeRequest sends the site-wide GitHub access token in the Authorization header to that endpoint. This can disclose a token with access to private repositories and enable source or release supply-chain compromise.

  src/Services/GitHubApi.php:22-33

  Recommendation

  Restrict asset URLs to the expected api.github.com/uploads.github.com hosts using strict hostname and scheme allowlists, never attach credentials across hosts or redirects, and require an administrator-level release capability.

• high Unrestricted release upload permits executable files in the EDD upload directory

  file_access

  The create-release route lets edit_products users provide an arbitrary file_name and upload file_zip bytes. The filename sanitizer preserves extensions, and executeFromUploadedFile moves the upload directly without wp_check_filetype_and_ext, MIME validation, or a .zip-only rule, then registers it as an attachment. On servers where the EDD directory is web-executable or its deny rule is ineffective, a product manager can upload and execute PHP; even when execution is blocked, arbitrary hosted payloads can be published as releases.

  src/Services/ReleaseFileProcessor.php:55-80

  Recommendation

  Require a .zip extension and validate both MIME and contents with wp_check_filetype_and_ext; generate the stored filename server-side, keep releases outside the web root, and restrict creation to a dedicated trusted release-manager capability.

• medium Any logged-in user can view arbitrary product release history

  information_disclosure

  The [edd-sl-releases] shortcode product view intentionally leaves the active-license gate commented out. Any authenticated user who can load a page containing the shortcode can supply ?edd-sl-product=<id> (or a shortcode product attribute) and read that product's release versions, release dates, requirements, and changelogs. Downloads remain license-gated, but private pre-release notes and version history for unlicensed products are exposed to every Subscriber-or-equivalent account.

  src/Services/Shortcodes/ReleasesShortcode.php:105-119

  Recommendation

  Re-enable the active-license check before listing releases, or restrict the shortcode output to products the current user has purchased; keep download authorization as a separate gate.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.