CodeDesign.ai Pages WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.3.69

Findings

3

Worst severity

high

Content hash

64e556824fb8dad2f9b8ec56… Copy

Findings

• high CodeDesign API key localized to every wp-admin user including Subscribers

  information_disclosure

  SettingsPage hooks admin_enqueue_scripts with no $hook screen guard and no current_user_can. enqueue_react_scripts always enqueues the settings React bundle and wp_localize_script('mnc_settings_page_script','wpData', ['apiKey' => get_option('mnc_api_key'), ...]). Subscribers can load /wp-admin/profile.php (capability read), so wpData.apiKey appears in their HTML. That secret is the only intended credential for CodeDesign sync; combined with public /mnc/v1/sync it lets a low-priv user drive a full project resync or use the key against CodeDesign's own API. The same function also echo (SCRIPT_DEBUG) on every admin request.

  settings-page.php:8-29

  Recommendation

  Enqueue and localize only on the plugin's manage_options screens (toplevel_page_mnc-settings / codedesign_page_codedesign-welcome). Do not put the raw API key in frontend JS; at most pass a boolean hasApiKey. Remove the echo (SCRIPT_DEBUG).

• medium Hardcoded Datadog API key ships in production and receives plugin logs

  hardcoded_credentials

  datadog-logger.php embeds Datadog API key 17fadf5c4b4704d6b52373537084fdf5 and POSTs JSON logs to https://http-intake.logs.datadoghq.com/v1/input/{key}. validate_api_key() calls this on every unauthenticated validation attempt, including print_r of the full wp_remote_post response. Anyone who reads the public plugin can send logs to the same intake (cost/abuse) and the key cannot be rotated without a plugin update. This is a live third-party credential in a GitHub-distributed plugin, not a placeholder.

  datadog-logger.php:2-26

  Recommendation

  Remove the hardcoded key from the distributed plugin. If remote logging is required, store the key in wp-config.php or an environment variable, gate logging behind an explicit admin opt-in, and rotate the exposed Datadog key immediately.

• medium TLS certificate verification disabled on CodeDesign API calls that write site content

  insecure_config

  validate_api_key() POSTs the site hostname and API key to ConfigManager base_hostname (production.api.codedesign.app in production) with sslverify => false. sync_function and sync_function_individual add_filter('https_ssl_verify','__return_false') and https_local_ssl_verify before wp_remote_get of the project JSON and the admin-ajax loopback that publishes pages. A network attacker who can MITM the host can feed a forged 'valid' key response or forged blueprint JSON; those values are written to cc_project_data and published as pages. The comment says 'for development API' but the code runs unconditionally.

  codedesign-connector.php:282-288,692-694,914-916

  Recommendation

  Enable sslverify (default true) on all wp_remote_* calls. Do not globally filter https_ssl_verify off; if a loopback AJAX call needs a special case, use a dedicated internal method instead of HTTP to admin-ajax.php.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.