Render Command WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.0

Findings

2

Worst severity

high

Content hash

d0a0b42c44a6d2af9e791a75… Copy

Findings

• high Unauthenticated per-request plugin disable via hardcoded/default HMAC key

  predictable_token

  On activation, activate() file_put_contents()s wp-content/mu-plugins/render-command.php (LOCK_EX, chmod 0644). That MU-plugin always hooks option_active_plugins at priority 9999. On any non-is_admin() request that has GET exclude_plugins and exclusion_token, it HMAC-SHA256s the fixed message 'render-command-exclusion' with AUTH_SALT, or with the literal 'render-command-fallback-salt' when AUTH_SALT is undefined, empty, false, or '0'. hash_equals() then authorizes filtering; exclude_plugins=__ALL__ returns [] (no regular plugins load). The CLI path in RenderCommand::__invoke errors if AUTH_SALT is missing ('requires AUTH_SALT ... for security'), but the web-facing MU-plugin still accepts the public fallback token 5368a5c666c085792e6b4e5a0505feca4d09dc7923ca97d9ef0da86382b65f6b. The plugin also uses the AUTH_SALT constant directly instead of wp_salt('auth'); WordPress core treats 'put your unique phrase here' (wp-config-sample.php) as insecure and replaces it with a DB-backed secret, so sites left on the sample phrase accept the second public token fabebef0696ec3d6c20811ca31c07738ccebe0be38180c2330181985946b409c. getenv()-style defines that leave AUTH_SALT false/empty take the fallback. is_admin() is false for wp-login.php, REST, XML-RPC, wp-cron.php, and the front end, so 2FA/limit-login/WAF/membership plugins can be skipped for an unauthenticated request. Token is non-expiring, not bound to path/time/IP, and is passed in the query string. Probe: GET /wp-content/plugins/render-command/readme.md then GET /wp-login.php?exclude_plugins=__ALL__&exclusion_token=<fallback-or-default>. Network-activated plugins (multisite) and other MU-plugins are not filtered. Deleting the plugin folder without deactivating leaves the MU-plugin in place.

  render-command.php:40-43,72-106

  Recommendation

  Do not ship a hardcoded HMAC key. In the MU-plugin, refuse to filter unless a dedicated high-entropy secret exists (random option generated on activation, or wp_salt('auth') — never AUTH_SALT constant and never a fallback string). Reject WordPress's sample phrase 'put your unique phrase here' the same way wp_salt() does. Align the web gate with the CLI check: if AUTH_SALT/secret is missing, no-op. Bind tokens to a short TTL and to the path; pass them in a header or POST, not GET. Do not install the MU-plugin until the operator explicitly enables --without-plugins support. On deactivation and uninstall, delete the MU-plugin; add an uninstall.php so deleting the plugin folder without a clean deactivate does not leave the backdoor.

• medium Always-on MU-plugin debug switch with non-expiring query-string token

  dev_tool_in_production

  The product is a WP-CLI debug aid, but activation always deploys mu-plugins/render-command.php for every subsequent front-end request, even if nobody ever runs wp render --without-plugins. When AUTH_SALT is unique the HMAC is unguessable, yet --link (v1.2.0) prints the full URL including exclusion_token to stdout, and every successful --without-plugins request puts that token in the query string (web server access logs, CDN logs, browser history, Referer to third-party assets on the rendered page). The token never rotates except when AUTH_SALT is changed (which also invalidates auth cookies). Anyone who later obtains that URL can disable arbitrary regular plugins on wp-login.php / REST / the front end with no capability check. sslverify is also false on the CLI wp_remote_get, which is operator-local rather than a web issue.

  render-command.php:153-154,286-297

  Recommendation

  Keep plugin-exclusion off until an explicit opt-in constant or setting is enabled; remove the MU-plugin when the feature is unused. Issue single-use or time-boxed tokens stored hashed in an option, not a static HMAC of AUTH_SALT. Prefer a request header over query arguments so the secret is not written to access logs or leaked via Referer. Do not add --link output of live secrets in CI-friendly stdout without a warning. Restore sslverify to true (or honor https_ssl_verify) on wp_remote_get.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.