High-severity findings.

Audited release

1.1.4

Findings

6

Worst severity

high

Content hash

eb59ab422a5829884ea0670b… Copy

Findings

• high Site and plugin CPTs use post capabilities, exposing fleet API keys and auto-login to Editors

  missing_capability

  wpjugglersites, wpjugglerplugins, and wpjugglertools are registered with capability_type 'post' and an empty capabilities array (inline TODO to fix create/edit caps). show_in_menu=>'wpjs-dashboard' only hides the menu for users without manage_options; it does not block /wp-admin/edit.php?post_type=wpjugglersites or post.php. Editors (edit_others_posts) can open any managed-site post and read the API key and remote login username rendered in the metabox, change wp_juggler_server_site_url / automatic login / ping URL, and save via wpjs_save_sites_meta_boxes which only checks edit_post. wpjs_generate_login_token signs an HS256 JWT with that API key and claim wpjs_username, which the client accepts for one-click wp-admin login. Editors can also publish wpjugglerplugins packages that serve_manifest exposes at /wpjs-plugins/, poisoning the private update channel. Authors can create their own site records. This is below manage_options and is the path to takeover of every connected client.

  includes/class-wpjs-admin.php:281-306

  Recommendation

  Register all three CPTs with a dedicated capability (e.g. capability_type 'wpjugglersite' mapped to manage_options, or cap 'manage_options' on every primitive). Keep show_ui behind the same cap. Do not print API keys into HTML for anyone who cannot manage the fleet; show a masked value and rotate only via a manage_options+nonce AJAX handler that also checks get_post_type($id)==='wpjugglersites'.

• high CSRF on fleet plugin install/activate/update AJAX (no nonce)

  csrf

  State-changing wp_ajax handlers that drive the client (wpjs-install-plugin, wpjs-activate-plugin, wpjs-deactivate-plugin, wpjs-update-plugin, wpjs-update-theme, wpjs-refresh-*, wpjs-start-cron) check only current_user_can('manage_options'). They never call wp_verify_nonce / check_ajax_referer, unlike ajax_save_settings. A cross-site POST to admin-ajax.php with the administrator's cookies (SameSite=Lax still sends on top-level form POST) invokes WPJS_Service::install_plugin($site_id, $plugin_url), which POSTs attacker-controlled pluginUrl to the client's /wp-json/juggler/v1/installPlugin. That is remote code execution on every managed site whose siteId the attacker can guess or enumerate from a prior CP session. Activate/deactivate/update similarly mutate client plugins. wp_create_nonce('wpjs-control-panel') is localized into the Vue app but is not consumed by these PHP handlers.

  includes/class-wpjs-ajax.php:1970-1986

  Recommendation

  Require check_ajax_referer (or wp_verify_nonce against the localized wpjs-control-panel nonce) on every state-changing AJAX handler before calling the client. Restrict installPlugin URLs to an allowlist (attachment IDs on this site or wordpress.org slugs). Do not accept an arbitrary pluginUrl from the request.

• high Broken nonce and edit_posts gate lets Contributors rotate any site API key

  missing_capability

  wpjs_reset_api_key is registered as wp_ajax_juggler_reset_api_key. It calls wp_verify_nonce($this->plugin_name, '-site', $nonce): WordPress's signature is wp_verify_nonce($nonce, $action), so this verifies the literal string 'wpjs' as a nonce for action '-site' and ignores the POST token; the boolean result is discarded. The only gate is current_user_can('edit_posts') — Contributor, Author, and Editor pass. There is no current_user_can('edit_post', $post_id), no post-type check, and no manage_options. Any such user (or a CSRF form against their session, including an administrator) can POST an arbitrary post_id, overwrite wp_juggler_api_key with a fresh UUID, and receive that secret in the JSON response. That disconnects the matching client (DoS of the management channel) and, combined with CPT edit access, lets an Editor plant a key they control. wpjs_user_search has the same broken wp_verify_nonce($this->plugin_name, '-user', $nonce) pattern.

  includes/class-wpjs-ajax.php:1711-1738

  Recommendation

  Call if (!wp_verify_nonce($_POST['wp_juggler_server_nonce'], 'wpjs-site')) wp_die(). Require current_user_can('manage_options') and get_post_type($post_id)==='wpjugglersites' (or current_user_can('edit_post',$post_id) after CPT caps are fixed). Do not return the new key to roles that should not see it.

• medium Unauthenticated /wpjs-plugins/ manifest dumps private plugin packages

  information_disclosure

  serve_manifest is hooked to template_redirect with no is_user_logged_in, capability, or shared-secret check. Any GET whose path is exactly /wpjs-plugins/ (hardcoded; the wpjs_cp_slug option is unused) loads every published wpjugglerplugins post and echoes JSON including version, slug, and download_url from wp_get_attachment_url. The README presents this as a private in-network plugin host. Clients need a fetchable manifest, but listing every package at a well-known unauthenticated URL plus typical public /wp-content/uploads/ attachment URLs lets anyone download proprietary/internal zips (license material, hardcoded endpoints) and learn which plugins the fleet runs. Inline TODO notes a planned temp-URL flow that was never implemented.

  includes/class-wpjs-plugins.php:53-121

  Recommendation

  Authenticate the manifest (client API key or a per-site signed token) or issue short-lived, unguessable download URLs as the TODO describes. Do not list all slugs to anonymous callers; require the slug and a token. Store packages outside the public uploads tree or gate them with a capability/token download handler.

• medium Client API calls disable TLS verification while sending Bearer API keys

  insecure_config

  WPJS_Service::call_client_api is the single outbound path for health/debug/checksum/plugin install/activate/update and auto-activation. It POSTs JSON to {site_url}/wp-json/juggler/v1/{endpoint} with Authorization: Bearer {wp_juggler_api_key} and sslverify => false, with an inline comment 'TODO SHOULD BE REMOVED FOR PRODUCTION'. check_front_end uses the same flag. A network attacker who can MITM the server-to-client path (captive portal, broken middlebox, DNS hijack of a managed host) reads every site's API key and can rewrite installPlugin bodies. Combined with HS256 auto-login JWTs keyed by that secret, stolen keys become one-click admin sessions on the client. This is compiled into the 1.1.4 release, not a dev-only branch.

  includes/class-wpjs-service.php:140-150

  Recommendation

  Enable sslverify (true) for all wp_remote_* calls. If local/dev exceptions are required, gate them on an explicit development constant, not a shipped default.

• medium Any client API key authorizes leftover fleet-wide REST cron endpoints

  unnecessary_attack_surface

  juggler/v1/triggerMultiCron, checkClientApi, and triggerSingleCron use permission_callback api_validate_api_key, which only checks that the Bearer token matches some wpjugglersites row. It does not bind the caller to that site_id. triggerMultiCron then runs check_all_plugins_checksum_api() against every activated site. checkClientApi runs the full uptime loop. triggerSingleCron ignores the authenticated site entirely and always calls WPJS_Service::check_notices_api(37) (hardcoded debug IDs in comments: 'mac 5' / 'firma 37'), then wp_send_json_success of that site's notice payload. A leaked key from one low-value client therefore triggers jobs (and notice exfil for post 37) across the fleet. These routes look like unfinished operator debug, not the client activation handshake (activateSite).

  includes/class-wpjs-api.php:169-217

  Recommendation

  Remove triggerSingleCron/triggerMultiCron/checkClientApi from the public REST API, or require a server-side operator nonce/capability. If a client must call back, authorize only that site_id and never run check_all_* or hardcoded post IDs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.