High-severity findings.

Audited release

2.3.0

Findings

2

Worst severity

high

Content hash

94a4e0a277eb50fb696d2ab8… Copy

Findings

• high Unauthenticated cache enable/disable via epc_toggle on is_admin() requests

  missing_auth

  Endurance_Page_Cache::is_enabled() is invoked from the constructor (hooks() → is_enabled('page')) on every request. When $_GET['epc_toggle'] is enabled or disabled and is_admin() is true, it writes those values into option mm_cache_settings and sends a Location header, with no current_user_can() and no nonce. is_admin() is not an authorization check: wp-admin/admin-ajax.php and admin-post.php define WP_ADMIN before wp-load.php, so an unauthenticated GET to /wp-admin/admin-ajax.php?epc_toggle=disabled persists the setting. The same GET on wp-admin/profile.php works for a Subscriber. nfd_reconcile_epc_htaccess (hooked on ajax init) calls is_enabled('page') and is_enabled('browser'), so one request can disable both page and browser cache and remove or rewrite the NFD EPC block in .htaccess. Early returns in is_enabled() skip the toggle only if another active plugin slug contains 'cach'/'wp-rocket' or the theme is headway/prophoto; on a default Endurance install those do not apply. Consequence: anyone on the internet can turn the host cache layer off (or on) and change Apache rewrite rules.

  endurance-page-cache.php:217-218,1252-1311,1963-1976

  Recommendation

  Move the toggle out of is_enabled() into a dedicated admin handler. Require current_user_can('manage_options') and check_admin_referer() (or a capability-checked admin-post action) before update_option('mm_cache_settings'). Do not treat is_admin() as authentication. Exit after the redirect.

• low Cache purge via GET lacks a nonce (admin CSRF)

  csrf

  do_purge() on init clears the full cache or the current URL when epc_purge_all or epc_purge_single is present. The only gates are is_user_logged_in() and current_user_can('manage_options'); there is no wp_verify_nonce. The admin-bar and plugin-row links are GET add_query_arg URLs, so a SameSite=Lax cookie is sent on a top-level GET. An attacker who tricks an administrator into opening https://victim/?epc_purge_all=1 forces purge_all() (file cache unlink tree and/or nginx PURGE plus CDN/UDEV purge). Blast radius is cache invalidation / origin spike, not content or role change.

  endurance-page-cache.php:1334-1346

  Recommendation

  Require a nonce on purge URLs (wp_nonce_url / check_admin_referer) and prefer POST for purge_all. Keep the manage_options check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.