Multisite-Content-Kopierer WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

1.6.0

Findings

4

Worst severity

high

Content hash

9bb664010df81eaee3e128f4… Copy

Findings

• high Authenticated AJAX can enqueue network-wide content copy without manage_network or nonce

  missing_auth

  mcc_insert_all_blogs_queue is hooked to wp_ajax_ only (any logged-in user) and performs no capability or nonce check. It reads offset/interval/content_blog_id/settings from POST and inserts queue items for every public blog in the network. Combined with other retrieve_* AJAX handlers registered from Multisite_Content_Copier_Network_Main_Menu::__construct on init, a Subscriber can drive the copier pipeline that the UI otherwise restricts to manage_network.

  inc/ajax.php:101-140

  Recommendation

  Require current_user_can('manage_network') and check_ajax_referer in every mcc_* AJAX handler; register handlers only for network admins.

• high Multiple MCC AJAX endpoints missing capability and nonce checks

  missing_capability

  Handlers retrieve_single_post_data, retrieve_single_blog_data, retrieve_single_user_data, retrieve_cpt_* , remove_item_id_from_list, mcc_get_sites_search, mcc_get_users_search, and mcc_get_blog_ajax_url lack current_user_can and nonce verification. They disclose post titles, blog details, usernames, CPT lists, and admin-ajax URLs, and mutate wizard session state.

  admin/pages/network-main-page.php:22-30,197-351

  Recommendation

  Gate all handlers with manage_network + nonce; return JSON errors on failure.

• medium Unauthenticated CPT selector AJAX on subdomain multisite with CORS bypass

  information_disclosure

  On subdomain installs, wp_ajax_nopriv_mcc_retrieve_cpt_selectors_data is registered. allow_http_origin returns true for that action during AJAX, enabling cross-origin unauthenticated enumeration of custom post types via switch_to_blog.

  admin/pages/network-main-page.php:26-27,268-289

  Recommendation

  Remove the nopriv registration and the allow_http_origin exception; require manage_network + nonce.

• low Site search AJAX builds LIKE query via string interpolation

  unsafe_input

  mcc_get_sites_search stripslashes the term then esc_sql(esc_like) and interpolates into LIKE. Not confirmed exploitable SQLi under wp_magic_quotes, but should use $wpdb->prepare.

  inc/ajax.php:12-35

  Recommendation

  Use $wpdb->prepare with placeholders for the LIKE clause; drop stripslashes in favor of wp_unslash only inside prepare.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.