Companion Plugin WP Registry grade F. Critical findings · 2 findingsWP RegistryCritical findings · 2 findingsOpen the reportF

Critical findings.

Audited release

1.18

Findings

2

Worst severity

critical

Content hash

c834582580fdbae90bced481… Copy

Findings

• critical Unauthenticated auto-login as demo administrator when auto_login is set

  auth_bypass

  companion_after_setup_theme is hooked to after_setup_theme with no capability, nonce, or request secret. If get_option('auto_login') is truthy and $_SERVER['REQUEST_URI'] is exactly '/', it calls wp_signon() as hardcoded user_login demo using get_option('jurassic_ninja_admin_password'). wp_signon fires companion_wp_login, which immediately update_option('auto_login', 0), POSTs the site hostname to companion_api_base_url/checkin, and wp_safe_redirect('/wp-admin'). Jurassic Ninja provisioning sets those options on every launched site; the plugin itself never requires a token in the URL (later Atomic builds use /?auto_login, this 1.18 tag uses bare /). The first unauthenticated visitor therefore obtains the demo administrator session. The plugin returns early only when IS_ATOMIC is defined, so a full JN site import onto ordinary WordPress leaves this path armed until the first login. There is no register_activation_hook that sets auto_login; the option is an external provision flag, but that is the intended production mode of this plugin.

  companion.php:205-216

  Recommendation

  Do not auto-login from an unauthenticated GET to /. If a first-visit convenience login is required, gate it on a single-use, short-lived secret in the URL (HMAC or one-time token), refuse when the token is missing/empty, and disable the entire companion stack unless an explicit JN provision flag is present. On non-JN hosts (not only Atomic), return before registering after_setup_theme / wp_login.

• high Admin and SSH credentials printed to every wp-admin user

  information_disclosure

  companion_admin_notices is hooked to admin_notices on both the main site and (via the early multisite return) on subsites, with no current_user_can() check. WordPress runs admin_notices on every admin screen, including Subscriber-accessible /wp-admin/profile.php and the dashboard (capability read). The notice reads jurassic_ninja_admin_password and jurassic_ninja_sysuser (blog 1 on multisite) and echoes them as the demo password, SSH password, and an sftp://user:pass@host/path URI, plus get_home_path(). After auto_login has been consumed, this is a persistent privilege-escalation path: any additional account (Subscriber/Author/Editor, or a tester user created on the playground) can open wp-admin, copy the administrator password, and sign in as demo, or SSH as the sysuser. Credentials are escaped for HTML (esc_html) so this is disclosure, not XSS. The only screen skip is post.php; Settings → Jetpack Constants (manage_options) is unrelated to who sees the notice.

  companion.php:42-88

  Recommendation

  Wrap the notice in current_user_can('manage_options') (or a dedicated capability). Do not render SSH/SFTP secrets into HTML at all; show them only on an admin-only screen after a fresh nonce. Clear jurassic_ninja_admin_password / jurassic_ninja_sysuser when the plugin detects it is not on a JN host.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.