smarTrack WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.1.9

Findings

2

Worst severity

medium

Content hash

44adeb8da741eee120109e04… Copy

Findings

• medium Unauth update_pview_data updates arbitrary strack_st rows by id

  missing_auth

  wp_ajax_nopriv_save_pview_data passes attacker-controlled $_POST['id'] into sTrack_DB::update_row with no capability/nonce, allowing pollution of analytics rows.

  classes/Core.php:47-84

  Recommendation

  Validate ownership/token for the pageview id; rate-limit; prefer insert-only for public tracking.

• medium Remote update checker unserialize of HTTP body

  unsafe_unserialize

  STRACK_PLU_Auto_Plugin_Updater::getRemote_information unserialize()s wp_remote_post body from the vendor API without integrity checks (object injection if the update host is compromised or MITM).

  classes/STRACK_PLU_Auto_Plugin_Updater.php:170-174

  Recommendation

  Use JSON with json_decode; never unserialize remote data.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.