IDkollen WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

0.3.3

Findings

3

Worst severity

high

Content hash

c19d401406031a913677e803… Copy

Findings

• high Unauthenticated REST callback writes arbitrary options via add_option

  missing_auth

  POST /wp-json/elseifab/idkollen/v1/callback uses permission_callback that always returns true. Callback::boot reads JSON itemId and idkToken and calls add_option($itemId, $token) with no authentication or itemId allow-list. An unauthenticated attacker can create new options (any name that does not already exist), planting attacker-controlled values that other code may later trust, and can complete or spoof seal-service callbacks.

  src/Auth/Callback.php:7-26

  Recommendation

  Authenticate callbacks (shared secret/HMAC from IDkollen), restrict itemId to values previously created by Init (uniqid idkollen*), and avoid add_option with raw client input.

• medium Unauthenticated REST item endpoint returns get_option values

  information_disclosure

  GET /item/(?P<item>[a-zA-Z0-9-]+) has no permission_callback and returns get_option($item). Option names with underscores are excluded by the regex, but names like siteurl, home, blogname, and plugin keys matching the pattern are disclosed to anonymous clients. Also used to poll BankID tokens.

  src/Auth/Item.php:7-11

  Recommendation

  Require a capability or signed token; only allow reading keys previously created for the auth wait flow.

• medium Admin settings save API key without nonce (CSRF)

  csrf

  AdminMenu::render() writes ApiKeyManager::set from $_REQUEST['apiKey'] (and timeout/debug) whenever the settings page loads with those parameters. The submenu requires manage_options, but there is no check_admin_referer. A CSRF request from an admin's browser can overwrite the IDkollen API key.

  src/Settings/AdminMenu.php:13-27

  Recommendation

  Process saves only on POST with check_admin_referer and capability re-check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.