BoldGrid Inspirations WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

2.3.1

Findings

4

Worst severity

high

Content hash

e7578f047e8d8b724bbad3cd… Copy

Findings

• high Subscriber can overwrite the site-wide BoldGrid Connect Key via wp_ajax_addKey

  missing_capability

  The live Connect Key save path is Boldgrid\Library\Library\Notice\KeyPrompt::addKey (wp_ajax_addKey). It validates only the boldgrid_set_key nonce, then hashes the posted key, calls the asset server, and Key::save() writes site options boldgrid_api_key and boldgrid_site_hash. There is no current_user_can(). The nonce is printed by keyNotice() on admin_notices whenever the prompt is not dismissed — that hook fires for any user who can load wp-admin, including a Subscriber on profile.php. The success JSON also returns site_hash and the stored api_key. The plugin's own Boldgrid_Inspirations_Api::set_api_key_callback() correctly requires manage_options and even documents 'BoldGrid API keys can only be saved by Admins', but that method is never registered on an AJAX action. PostNewKey::processPost (admin_init Central return) does require update_plugins. Consequence: a Subscriber replaces the owner's Connect Key, hijacks or breaks paid-image/coin/update traffic, and learns the new site_hash.

  vendor/boldgrid/library/src/Library/Notice/KeyPrompt.php:186-305

  Recommendation

  In KeyPrompt::addKey (and Key::addKey if called from AJAX), require current_user_can('manage_options') before saving, matching set_api_key_callback() and PostNewKey::isPosting(). Do not print the Connect Key form or nonce for users who cannot manage_options. Do not return api_key/site_hash in the AJAX response.

• medium wp_ajax_activate_staging activates a plugin with no capability or nonce check

  missing_capability

  Boldgrid_Inspirations_Staging::add_hooks() registers wp_ajax_activate_staging → activate(). The handler calls WordPress activate_plugin('boldgrid-staging/boldgrid-staging.php') with no check_ajax_referer and no current_user_can. activate_plugin() itself does not enforce capabilities (callers are expected to). Any logged-in user, including a Subscriber, can POST action=activate_staging and, if that plugin file is already on disk (installed but inactive, leftover from a prior Inspirations deploy), activate it and run its activation hook. The sibling install() endpoint does check nonce-install-staging and install_plugins; activate() does neither, so it is also a CSRF against any logged-in session.

  includes/class-boldgrid-inspirations-staging.php:33-73

  Recommendation

  Require current_user_can('activate_plugins') (or install_plugins, matching install()) and check_ajax_referer('nonce-install-staging') before calling activate_plugin(). Fail closed for missing nonce.

• medium Stock-photo download AJAX is CSRF-able for users who can upload or edit the target post

  csrf

  wp_ajax_download_and_insert_into_page checks capability (edit_page/edit_post on the given post_id, otherwise upload_files) but never verifies a nonce. A CSRF page can force an Author/Editor (or a Contributor who can edit that post) to download a remote stock image into the media library and, when post_id is set, generate editor markup for that post. The download talks only to the configured asset_server (not an open SSRF), but it is still an unauthenticated-cross-site state change on a privileged media action. WordPress core media AJAX uses a nonce; this custom action does not.

  includes/class-boldgrid-inspirations-stock-photography.php:229-250

  Recommendation

  Call check_ajax_referer() (e.g. the media-form nonce already available in the media modal, or a dedicated nonce localized only on screens that offer BoldGrid Connect Search) before downloading or attaching.

• medium Hashed Connect Key is printed into admin JavaScript for any user who can edit posts

  information_disclosure

  add_boldgrid_configs_to_header() json_encodes the plugin configs (including api_key from option boldgrid_api_key and site_hash) into IMHWPB.configs on several admin screens. allow_header_configs() returns true on edit.php, post.php, and post-new.php for current_user_can('edit_posts') — i.e. Contributor and above — not only for users who can upload files or manage options. Client JS (image_search.js, ajax.js) then sends that key to the BoldGrid asset API. A Contributor who cannot use Connect Search still receives the site-wide secret in page source. The code even comments '@todo Only add configs for certain roles/capabilities.'

  includes/class-boldgrid-inspirations-inspiration.php:456-548

  Recommendation

  Never print api_key or site_hash into pages for users who do not need them. Restrict full configs to manage_options (or at least upload_files on the Connect Search / media-upload screens). Perform asset-server calls server-side with the stored key instead of exposing it to the browser.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.