High-severity findings.

Audited release

0.8

Findings

2

Worst severity

high

Content hash

a20884a2654d0eb797bd36d3… Copy

Findings

• high Missing capability and nonce on Puffin credential update

  missing_capability

  Admin is constructed on every admin_menu run. Its constructor immediately processes POST action=puffin_update_creds and writes options_puffin_client_secret, options_puffin_client_token, client_id, token_url, and app_url via update_option with no current_user_can check and no nonce. Any logged-in user who can load wp-admin (including Subscriber on profile.php), or a CSRF victim, can overwrite mail-bridge OAuth secrets and redirect token/app URLs. Rendered form also echoes option values without escaping, enabling stored admin XSS after a malicious write.

  BWPuffin/Admin.php:10-96

  Recommendation

  Gate postPuffinCredentials with current_user_can('manage_options') and check_admin_referer; move processing to admin_post/admin-ajax; escape all echoed option values with esc_attr.

• medium CSRF on Puffin credential form (no nonce field)

  csrf

  The credentials form posts action=puffin_update_creds with no wp_nonce_field. Combined with missing capability checks, a cross-site POST from an authenticated admin session can silently replace client_secret and API endpoints.

  BWPuffin/Admin.php:52-72

  Recommendation

  Add wp_nonce_field and verify with check_admin_referer before updating options.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.