Medium-severity findings.

Audited release

1.4.1

Findings

1

Worst severity

medium

Content hash

c384e2f2913a1e6a9a65a4c5… Copy

Findings

• medium Log files written under wp-content/uploads/logs are world-readable on nginx and non-permalink Apache

  information_disclosure

  Logger::instance() always opens a Monolog StreamHandler at WP_CONTENT_DIR/uploads/logs/{slug}-{Y-m-d}.log (default level INFO). Protection is delegated to bundled bh-wp-private-uploads, which (1) uses an empty post type so REST/media hooks are skipped, (2) writes only an index.php guard — the library comments that a deny-all .htaccess would 403 authorised PHP downloads — and (3) registers an Apache external rewrite of uploads/logs/(.*) to index.php?-private-uploads-file=$1 plus Serve_Private_File on init (manage_options). Two wrapping bugs make that fail on common installs: instantiate_bh_wp_plugins_page() returns immediately unless is_admin() || wp_doing_ajax(), so Serve_Private_File, the hourly is-private HTTP probe, and delete_logs_{slug} cron are never registered on front-end or wp-cron.php requests; and maybe_flush_rewrite_rules() refuses to write .htaccess unless pretty permalinks, mod_rewrite, and a non-AJAX admin load are all true. nginx/OpenLiteSpeed/IIS serve the existing .log as a static file (predictable URL /wp-content/uploads/logs/bh-wp-plugins-page-YYYY-MM-DD.log) without ever hitting PHP. ERROR/WARNING entries include debug_backtrace. On multisite the write path (WP_CONTENT_DIR/uploads/logs) also diverges from the rewrite target (wp_upload_dir() basedir, typically uploads/sites/{id}/logs), so even a working Apache rule protects the empty directory.

  vendor-prefixed/brianhenryie/bh-wp-logger/includes/class-logger.php:117-206

  Recommendation

  Write logs outside the web root (or under a randomly named directory that is not mapped as a static alias). Emit a directory-level deny (Apache Require all denied / nginx location deny) independent of permalinks, and use wp_upload_dir()['basedir'] consistently so the rewrite target matches the files. Remove the is_admin()/AJAX-only bootstrap around Logger::instance() so Serve_Private_File and the is-private cron actually run on front-end and wp-cron.php. Add current_user_can('manage_options') next to the existing nonces on the logger delete/download handlers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.