Medium-severity findings.

Audited release

1.5.4

Findings

3

Worst severity

medium

Content hash

75bd40d08cf8cea315750e9f… Copy

Findings

• medium config.env with environment URLs is web-readable in the plugin directory

  information_disclosure

  On every request config::__construct() copies config.env.example to config.env in the plugin folder if the file is missing, then Symfony Dotenv loads it. There is no .htaccess, web.config, or index deny. WordPress does not block .env, so a default Apache/nginx vhost serves GET /wp-content/plugins/staging-indicator/config.env as a static file to unauthenticated clients. That file is the only settings store: SITE_N_NAME/SITE_N_URL (Dev/UAT/Live), SITE_EXT, STAGE, VERSION, LASTUPDATE, SITE_BROADCAST. Those URLs are often internal hostnames, non-public staging copies, or even user:pass@ URIs. The same folder will also serve externalsites.json.cache after loadExternalSites() writes the remote JSON. This is default-on after the first page view; it does not require SITE_BROADCAST. The admin bar shows the same names/URLs to every logged-in role (no current_user_can on admin_bar_menu), but the HTTP file is the unauthenticated path.

  config.php:29-33

  Recommendation

  Do not keep secrets or environment maps under wp-content/plugins. Store settings with update_option() or a file outside the document root. Until then, deny web access to *.env and *.cache (Apache FilesMatch deny, nginx location). Never put credentials in SITE_N_URL.

• medium SITE_BROADCAST hijacks every WordPress request with ?c=1 and dumps the site list unauthenticated

  information_disclosure

  After new config(), index.php checks Broadcast (SITE_BROADCAST) and $_GET['c'] == 1 (loose compare) at plugin-load time, then prints json_encode($configLoader->Sites) and die(). There is no capability, nonce, token, or is_admin() gate. The branch runs for unauthenticated frontend, wp-login, checkout, and REST as long as the query string contains c=1/1abc/true. config.env.example documents this as 'Shows site list on a call to index.php?c=1' so that other installs can pull via SITE_EXT, but the check is not limited to the plugin file: it replaces the entire front controller. Direct /wp-content/plugins/staging-indicator/index.php fatals on add_filter() before this branch, so the live unauth handler is any WP URL. Default SITE_BROADCAST is false; enabling the documented multi-site switcher turns it on. Observable: GET /?c=1 returns [{"Name":"Dev","URL":"https://..."}, ...] and no HTML.

  index.php:28-33

  Recommendation

  Do not die() on an arbitrary front-controller query arg. If a pull API is required, register a REST route with a shared secret (or application password) rather than a public ?c=1 flag, and never run it on every request. Keep SITE_BROADCAST off on production unless that token is in place.

• low No upstream commits since 2018; Symfony 3.3 and Carbon 1.22 remain vendored

  unmaintained

  GitHub bredigital/staging-indicator last functional commit is 2018-02-23 (LICENSE-only commit 2018-10-25). The zip vendors nesbot/carbon 1.22.1 (2017-01-16) and symfony/dotenv + translation v3.3.13 (EOL). There is no Update URI in the plugin header, so sites will not receive GitHub releases through the WP updater. Carbon 1.22.1 is in the CVE-2025-22145 setLocale file-include range (<2.72.6); this plugin never calls Carbon::setLocale with request input, so that CVE is not a working RCE here, but the unmaintained stack will not pick up future library fixes. Symfony Dotenv 3.3 can expand $(command) if Symfony Process were present; Process is not shipped, so that path throws instead of executing.

  index.php:1-8

  Recommendation

  Replace with a maintained environment-indicator that stores settings in options, gates the admin bar on a capability, and does not vendor EOL Symfony 3.3. If this plugin must stay, move config out of the web root and drop the ?c=1 die() path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.