Medium-severity findings.

Audited release

3.8.8

Findings

3

Worst severity

medium

Content hash

9fd0a1a2391f741e9411c3bf… Copy

Findings

• medium Unauthenticated AJAX writes mashsb_jsonshares on any post

  missing_auth

  wp_ajax_nopriv_mashsb_set_fb_shares maps to mashsb_set_fb_sharecount with no authentication, capability, or nonce check (front-end JS localizes mashsb.nonce from wp_create_nonce('mashsb-nonce') and sends it, but PHP never calls wp_verify_nonce). Any visitor POSTs postid (intval) and shares to admin-ajax.php; the handler always update_post_meta($postId, 'mashsb_jsonshares', json_encode($cacheJsonShares)) and will update mashsb_shares if mashsb_get_total_shares() exceeds the cached total. Because shares is intval()'d, nested comment_count/share_count are currently forced to 0 so Facebook fields in the JSON cache are zeroed rather than inflated, but the unauthenticated write to arbitrary post meta remains. mashsb_jsonshares is the per-network share cache consumed by mashsb_get_total_shares() and rewritten on cache refresh.

  includes/sharecount-functions.php:20-54

  Recommendation

  Require wp_verify_nonce on mashsb-nonce (or a dedicated action), restrict postid to an existing public post, and drop the nopriv hook unless unauthenticated writes are truly required. Treat $_POST['shares'] as an array of ints (share_count/comment_count) only after is_array() + absint, and never lower mashsb_shares from this endpoint.

• medium Subscriber can reorder or empty mashsb_networks via AJAX (CVE-2025-22319)

  missing_capability

  wp_ajax_mashsb_update_order -> mashsb_save_order has no current_user_can and no nonce. Any logged-in user, including Subscriber, can POST mashsb_list[] to admin-ajax.php and rewrite the mashsb_networks option. mashsb_get_networks_list() reads that option to build the Social Networks settings table; sending an empty or partial list drops networks from that table so a subsequent administrator settings save can remove them from mashsb_settings['networks'] (the array mashsb_getNetworks() renders on the front end). Admin JS sortable posts serialize() + action=mashsb_update_order with no nonce, so the same request is also CSRF against any logged-in session. This matches public CVE-2025-22319 (missing authorization, Subscriber+, no official patch through 4.0.47).

  includes/admin/admin-actions.php:38-55

  Recommendation

  Gate mashsb_save_order with current_user_can('manage_options') and check_ajax_referer. Reject empty mashsb_list so a partial POST cannot wipe the network catalog. Send a nonce from mashsb-admin.js sortable update.

• medium Deactivation-feedback AJAX sends mail with no capability or nonce

  missing_capability

  wp_ajax_mashsb_send_feedback parses attacker-controlled $_POST['data'] via parse_str, then wp_mail() to makebetter@mashshare.net using mashsb_disable_from as From and Reply-To and mashsb_disable_reason as subject. There is no current_user_can, no nonce, and no is_email() check. Any Subscriber can trigger outbound mail from the site; the plugins.php modal is only an UI, not a gate. From/Reply-To are interpolated into header strings, so a From value with CR/LF is an email-header injection attempt (wp_mail/PHPMailer may reject it depending on core version). CSRF from any logged-in user is sufficient.

  includes/admin/feedback.php:56-88

  Recommendation

  Require current_user_can('activate_plugins') (the capability needed to reach plugins.php) and check_ajax_referer. Validate From with sanitize_email/is_email and pass addresses through wp_mail's From filter rather than raw header strings. Rate-limit the endpoint.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.