WP Beacon WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.12.0

Findings

1

Worst severity

high

Content hash

99f8c24832571e49bf30d014… Copy

Findings

• high User Switcher switch-back not bound to the admin's session: switched-to user can become administrator

  auth_bypass

  handleSwitchTo() stores the administrator's ID in the target user's protected meta _dr_beacon_switched_from and logs in as the target. handleSwitchBack() only checks is_user_logged_in() and a nonce for the current user, then reads that meta and calls wp_set_auth_cookie() for the stored (administrator) ID. Nothing ties this to the admin's original session token. The meta is not removed on logout or session expiry, and the plugin itself gives the current user the switch-back nonce (hidden form rendered in wp_footer/admin_footer whenever the meta is set, and /beacon/v1/admin/user-switch-status returns a ready-made switch_back_url). So the real owner of the switched-to account (any role, e.g. Subscriber or Customer) can, from their own browser, either concurrently or any time after the admin abandons the switched session, click 'Switch back to <admin>' and receive a full administrator auth cookie.

  src/Admin/Actions/Workshop/UserSwitcherAdminActions.php:44-52,58-87

  Recommendation

  Bind the switch to the session: store the original user ID and the admin's session token in a signed, HttpOnly cookie or in the switched session's token meta (as the User Switching plugin does), verify it on switch-back, and clear the marker on logout/wp_logout and when the switched session ends. Never render the switch-back form from user meta alone.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.