Mworago Ping WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

2.4.1

Findings

1

Worst severity

high

Content hash

bbfc93bbc6fc6dc6e3d40c36… Copy

Findings

• high Hardcoded default X-App-Token for public ping REST endpoint

  hardcoded_credentials

  kpopify_ping_verify_token compares the X-App-Token header to get_option('kpopify_ping_app_token_hash', KPOPIFY_PING_DEFAULT_TOKEN_HASH). The default is hash('sha256', 'kpopify-app-v2-ping-2026'), with the plaintext secret defined in the plugin. On any install that has not rotated the token, an unauthenticated client can POST /wp-json/kpopify/v1/ping and increment WordPress Popular Posts counters for arbitrary published/private post IDs (within cooldown/burst limits), poisoning popularity metrics and consuming burst quotas.

  mworago-ping.php:21-103

  Recommendation

  Remove the shipped default secret. Require admins to set a random token before the route accepts traffic (fail closed when the option is empty). Rotate any deployments still using the documented default.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.