WP Update Provider WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.1.8

Findings

2

Worst severity

high

Content hash

4c248f00629322f60dc30cc6… Copy

Findings

• high Inverted delete nonce CSRF-deletes packages; other admin actions have no nonce

  csrf

  viewPackagePage() is the manage_options callback for page=wup_package. For GET action=delete it takes $_REQUEST['_wpnonce'] and, if wp_verify_nonce(..., 'wup_delete_domain') FAILS, calls $wpdb->delete on {$wpdb->prefix}wup_packages keyed by $_GET['domain'] (the domain-row id from the list-table link, wrong table). A successful nonce therefore does nothing (the intended domain delete is inverted), and a missing/garbage nonce deletes a package. That is a GET CSRF: an administrator visiting attacker HTML with <img src="…/wp-admin/admin.php?page=wup_package&package=any&action=delete&domain=1"> drops package id 1 with no prompt. action=newKey has no nonce at all and UPDATEs deployKey WHERE slug=$_GET['package'], so a similar GET rotates CI credentials and locks out legitimate publishers. addPackagePage POSTs package[name]/package[slug] to admin.php?page=wup with no nonce or sanitize, and mainPage() INSERTs them via string SQL. Observable: missing packages / rotated deploy keys / attacker-named packages, which breaks or hijacks the update channel for every client site.

  lib/class.php:156-201

  Recommendation

  Invert the nonce check (delete only when wp_verify_nonce succeeds), delete from wup_domains using the domain id, and require check_admin_referer on newKey, addPackage, dashboard ZIP upload, and delete. Use $wpdb->update/$wpdb->insert with placeholders. Change destructive actions to POST.

• low No upstream commits since v0.1.8 (2019-02-11)

  unmaintained

  GitHub Ed-ITSolutions/wp-update-provider latest tag v0.1.8 was published 2019-02-11 (24 zip downloads); HEAD commit a4766cef is the same date. The plugin still ships PHP 5.3-era Composer constraints, uses wp_create_nonce as a long-lived API key, never flush_rewrite_rules() on activation, and contains the unauthenticated XSS/SQLi/CSRF issues above with no later patch release. Sites running it as a private update origin have had no vendor fix path for seven years.

  wp-update-provider.php:2-8

  Recommendation

  Do not expose this plugin on a production origin until the XSS/SQLi/CSRF issues are patched and a new tagged release is published. Prefer a maintained private update stack (e.g. GitHub updater / Composer satis) or fork and fix prepare/escaping/nonce before use.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.