Lucid Edge Cache WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

0.10.5

Findings

3

Worst severity

high

Content hash

69501946e07d2ead9dbc72a5… Copy

Findings

• high Spoofable preload header stores query-string HTML as the public page

  missing_auth

  An unauthenticated visitor can poison the anonymous page cache. LEC_Cache::bypass_reason() skips the query-string bypass whenever the request merely contains an X-Lucid-Cache-Preload header. That header is not a secret: the preloader sends the static value 1, and any client can do the same. start_capture() then buffers the response, and store_response() writes the body to a path built only from the URL path (relative_cache_path uses PHP_URL_PATH), ignoring the query string. The drop-in refuses to serve a request that has a query string, then the next normal GET is a HIT and readfile() sends the stored body as text/html to every logged-out visitor for the TTL (default 6 hours). A concrete case is a WooCommerce shop or category URL with orderby, min_price, or attribute filters: that variant replaces the canonical page. If the origin reflects the query string into the HTML, the reflection is stored and the browser runs it. A front-end URL that shows private data for a query token without Set-Cookie is likewise stored and replayed. When Spaces constants are set, settings() forces spaces_enabled and the same body is PUT with x-amz-acl public-read. store_response() never reads the enabled flag, so Emergency disable (which only makes the drop-in return early and deletes existing files) does not stop a later poisoned write or the public Spaces upload. Logged-in users, admin, ajax, cron, 404s, feeds, and responses that Set-Cookie are still excluded.

  includes/class-lec-cache.php:214-215

  Recommendation

  Do not treat X-Lucid-Cache-Preload as authorization. Keep rejecting every query string except a single cache-buster whose value is a site secret (hash_equals against a key that is not the literal 1), and still key the file on the path with that argument removed. Never store a response that carried any other query parameter. Check the enabled flag in start_capture() before buffering, and skip the Spaces upload when page caching is disabled.

• medium Drop-in cache path keeps .. and writes outside the cache directory

  file_access

  An unauthenticated GET or HEAD with no query string reaches dropins/advanced-cache.php before WordPress routing, as long as page caching is enabled and the visitor sends no protected cookie. The path is rawurldecode()'d and each segment is filtered with a character class that still allows dots, then trim(..., '-') which does not remove dots, so a segment of .. or %2e%2e survives. The resolved file is cache_dir/host/<segments>/index.html with no realpath() check that it stays under cache_dir. When that file is missing or older than the TTL, the drop-in mkdir()s dirname($file) with mode 0750 and fopen()s index.html.lock in mode c, which creates directories and an empty lock file anywhere the PHP user can write. If a fresh index.html already exists at the traversed path, readfile() sends it to the attacker as text/html. The same segment filter is duplicated in LEC_Cache::relative_cache_path() and used by store_response(); a traversal URL that WordPress still answers with HTTP 200 HTML would also write that HTML outside the cache root. Typical nginx php-fpm setups pass the raw REQUEST_URI through to index.php for unknown paths, so %2e%2e is decoded by this file rather than by the web server. The filename is fixed (index.html or index.html.lock) and the lock body is empty, so this is not arbitrary PHP write.

  dropins/advanced-cache.php:29-48

  Recommendation

  Drop any segment that is empty, `.`, or `..` after decoding, and reject the request if realpath(dirname($file)) is not inside realpath(cache_dir). Use that helper for both the drop-in and LEC_Cache::relative_cache_path() before mkdir, fopen, readfile, or file_put_contents. Do not rawurldecode a client path into a filesystem suffix without a prefix check.

• medium Unauthenticated admin-ajax request rewrites wp-config.php to force WP_CACHE

  missing_capability

  LEC_Admin::boot() runs whenever is_admin() is true, which includes unauthenticated /wp-admin/admin-ajax.php because admin-ajax.php defines WP_ADMIN before wp-load.php. It hooks ensure_prerequisites on admin_init with no capability check, and admin.php fires admin_init before the ajax action is authenticated. If WP_CACHE is not already true, ensure_prerequisites() calls LEC_Config::ensure_wp_cache(), which removes recognised WP_CACHE lines and writes a hardcoded define('WP_CACHE', true) into wp-config.php. A subscriber loading profile.php does the same. The observable consequence is that an operator who set WP_CACHE to false (so WordPress will not load advanced-cache.php) has that control turned back on by an anonymous request, and the drop-in starts serving and capturing HTML again. The written line is not attacker-controlled, and a file that already contains exactly one enabled definition is left unchanged. Separately, LEC_Cache::maybe_upgrade() is also on admin_init with no capability check: while the lec_version option differs from LEC_VERSION, the first admin-ajax hit installs the bundled drop-in, rewrites the runtime config, and runs the same wp-config normalisation. After the version option matches, that path returns immediately.

  includes/class-lec-admin.php:37-45

  Recommendation

  Run ensure_prerequisites() and maybe_upgrade() only for a user with manage_options, and return immediately when wp_doing_ajax() or the user is logged out. Do not rewrite wp-config.php from admin-ajax.php. If WP_CACHE is explicitly false, leave it alone instead of retrying on every administration request.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.