PS Support System WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

2.2.5

Findings

3

Worst severity

high

Content hash

af60a4ec61fc9f7d4fe0128d… Copy

Findings

• high Subscriber ticket replies are rendered through the_content (shortcode/oEmbed execution as staff)

  unsafe_input

  Ticket and reply bodies are stored with wp_kses_post() only (shortcodes are not stripped). PSource_Support_Ticket_Reply::__get('message') then runs apply_filters('the_content'), which in WordPress includes WP_Embed::autoembed and do_shortcode. The admin ticket-history table and the frontend single-ticket/reply templates echo that value unescaped. Default tickets_role includes subscriber, so any logged-in customer can open a ticket or reply containing arbitrary shortcodes (and standalone embed URLs). Staff must open that ticket to work it, at which point every registered shortcode and oEmbed handler runs with the administrator's capabilities. That is a privileged shortcode-execution primitive plus server-side oEmbed HTTP requests, not a cosmetic sanitization miss.

  inc/classes/class-ticket-reply.php:65-68

  Recommendation

  Do not run user-submitted ticket/reply content through the_content or do_shortcode. Escape on output (wp_kses_post at display time is already applied on insert) and, if rich text is required, keep a strict allowlist without shortcode processing. Strip shortcode markers on save for non-staff authors.

• high Admin list-table actions (delete/open/close/set default) have no nonce check

  csrf

  PSource_Support_Tickets_Table::process_bulk_action(), PSource_Support_FAQS_Table::process_bulk_action(), and the ticket/FAQ category tables perform state changes from GET or POST without wp_verify_nonce/check_admin_referer. Ticket row actions emit nonce-less links such as ?page=ticket-manager&action=delete&tid=ID (delete_ticket / manage_options) and ?action=close|open&tid=ID (allowed for the ticket owner, i.e. subscriber). FAQ manager similarly deletes on ?action=delete&fid=ID. Category tables delete or set_default from $_REQUEST['category'] with no nonce. A logged-in staff member who clicks an attacker-controlled link (or a subscriber lured to close/open their own ticket) triggers the action. Bulk POST bodies are also accepted without verifying the list-table nonce that WP_List_Table prints.

  admin/inc/class-table-tickets.php:261-307

  Recommendation

  Call check_admin_referer('bulk-' . $this->_args['plural']) (or a dedicated action) at the start of every process_bulk_action. Convert destructive row actions to POST forms or wp_nonce_url() + verify. Reject GET for delete.

• medium Single-ticket view and replies ignore requestor privacy (IDOR)

  auth_bypass

  psource_ticket_privacy=requestor is documented as allowing only ticket creators to see their own tickets. That filter is applied only to list queries (support_system_query_get_tickets_args and support_system_tickets_table_query_args). Direct object access is unfiltered: admin render_inner_page_details() loads psource_support_get_ticket(absint($_GET['tid'])) with no ownership check, and PSource_Support_Query::query() does the same for ?tid= on the frontend. The ticket-manager menu is registered with WordPress capability 'read' and shown to anyone with read_ticket (default: subscriber). The reply handlers (admin submit-ticket-reply and frontend support-system-submit-reply) require only insert_reply plus a nonce that is printed on the ticket page, with no ticket.user_id check. A subscriber who can guess or enumerate sequential ticket IDs can read other customers' messages/attachments and inject replies that email staff and the ticket owner. Default privacy is 'all' (shared queue); the bug is that switching to requestor does not actually protect single-ticket routes.

  admin/class-parent-support-menu.php:292-295

  Recommendation

  Enforce object-level authorization on every single-ticket read and write: if privacy is requestor and the current user is not staff (manage_options / assigned admin_id), refuse unless ticket.user_id === get_current_user_id(). Apply the same check in Query::query(), reply insertion, and close/open. Do not treat a valid nonce as proof of access to that ticket.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.