Save to Google Doc WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.7

Findings

1

Worst severity

medium

Content hash

f04e2a85cf1a7a1837fbc6eb… Copy

Findings

• medium OAuth callback accepts ?code= without binding to initiating admin session

  csrf

  check_oauth_flow consumes $_GET['code'] with stored PKCE verifier and writes access tokens when a verifier exists, without verifying OAuth state against the current user/session. If an admin has started connect flow (verifier stored), an attacker who tricks the admin into opening an attacker-controlled code URL (or races the redirect) can influence token establishment. Also lacks explicit manage_options check on the callback path.

  app/classes/class-wpc2-gdoc-auth.php:156-180

  Recommendation

  Validate OAuth state parameter tied to user session; require manage_options on callback; clear verifier atomically.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.