cm-plugin-install-from-url WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.3.6

Findings

1

Worst severity

medium

Content hash

691938e665a6f9633fbbc61c… Copy

Findings

• medium Encrypted private-asset download URL can mint an install_plugins session

  cookie_injection

  wp_ajax_nopriv_*_gh_download_private_asset decrypts GET args (Sodium secretbox keyed by wp_salt nonce, 12h skew), then wp_set_auth_cookie($uid) for the uid embedded in the blob before checking install_plugins and streaming a GitHub asset with the site PAT. Anyone who obtains the encrypted URL within the window (Referer logs, shared links, proxy logs) receives an authenticated session as that privileged user. Crypto is sound, but capability URLs that set auth cookies are a high-value leak target.

  class/Handlers/GitHub.php:271-334

  Recommendation

  Avoid setting auth cookies on nopriv endpoints. Stream the asset server-side under a short-lived capability token without establishing a browser session, or bind the token to the original user agent/IP and one-time use.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.