High-severity findings.

Audited release

2.3.6

Findings

2

Worst severity

high

Content hash

091ecbd2af34ca2efb0698ab… Copy

Findings

• high Open redirect via unvalidated redirect_uri on OAuth login/logout

  unsafe_input

  Routes::login accepts redirect_uri from the request without allowlisting against home_url, stores it in $_SESSION['oauth2redirect'], and redirects there after successful callback (and immediately if already authenticated). logout passes redirect_uri into the external logout URL. An unauthenticated attacker can phish users through the site OAuth flow to an attacker-controlled URL.

  src/Http/Routes.php:87-100

  Recommendation

  Allowlist redirect_uri to same-site paths (wp_validate_redirect / wp_safe_redirect semantics) before storing or issuing redirects.

• medium REST OAuth routes registered without permission_callback

  missing_permission_callback

  register_rest_route calls for login/register/callback/logout/subscription omit permission_callback. On older WP this defaults to public; on WP 5.5+ it triggers _doing_it_wrong. The subscription POST endpoint especially should explicitly define who may call it.

  src/Http/Routes.php:43-59

  Recommendation

  Set permission_callback to __return_true for intentional public OAuth endpoints, and a logged-in/token check for subscription updates.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.