LikeMyPost WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0

Findings

1

Worst severity

medium

Content hash

2fbd8fdeedf018651b98d294… Copy

Findings

• medium Unauthenticated like AJAX appends unbounded _likers_IP meta without a server-side duplicate check

  dos

  wp_ajax_like and wp_ajax_nopriv_like both call likeMyPost::like(). The handler only check_ajax_referer('worldsBestPluginEver') — the nonce is localized as LMPajax on every frontend page, and logged-out users share a uid-0 nonce — then takes raw $_POST['post_id'] and $_POST['event'] with no current_user_can, post_exists, absint, or alreadyLiked() gate. likePost() always ++ the _likes_count meta and appends REMOTE_ADDR concatenated with HTTP_USER_AGENT onto _likers_IP; the IP/UA uniqueness helper is used only to pick the Like vs Dislike link in the_content, not to reject a repeat vote. dislikePost() still decrements the count when alreadyLiked() is false. Because update_post_meta accepts any numeric object ID, this writes those two keys on posts, pages, attachments, drafts, and non-existent IDs. Observable: an unauthenticated visitor can inflate or drive negative public like totals and grow a serialized _likers_IP array without bound (large User-Agent × many requests), which alreadyLiked()/get_post_meta then load on front-end renders. The AJAX response is applied with jQuery .text(), so this is not XSS. Widget LIMIT $maxTag interpolation and admin tag-name echoes were traced: $maxTag is edit_theme_options-only after strip_tags, and $limiter is (int) pagination — not filed.

  likemypost-main.php:54-66,86-129,143-144

  Recommendation

  absint and post_exists() the post_id; refuse non-public types if likes are only meant for posts. Call alreadyLiked() inside likePost() and refuse a second like; only decrement in dislikePost() when the fingerprint is present. Store a unique fingerprint (hash of IP+UA) in a set with a max size, or replace the growing array with a dedicated table and unique index. Rate-limit the AJAX action. Keep the nonce, but do not treat it as a substitute for those server-side checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.