Frenzy WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.9.16

Findings

2

Worst severity

high

Content hash

3e4774c9bec1db0032b38f77… Copy

Findings

• high Unauthenticated SSRF via original_url in mockup generator

  ssrf

  frenzy_handle_generate_mockup is registered for wp_ajax_nopriv_frenzy_generate_mockup. Auth is only wp_verify_nonce(frenzy_nonce); that nonce is localized on product pages for anonymous shoppers. When original_url is supplied and frenzy_path_from_url does not map it into uploads, the handler calls download_url($original_url), causing the WordPress server to fetch an attacker-chosen URL (SSRF). previous_* URLs are constrained to frenzy-mockups by frenzy_resolve_mockup_file_path, but the download_url branch is not.

  includes/mockup/handlers-generate.php:62-68

  Recommendation

  Do not call download_url on user-supplied URLs from nopriv handlers. Restrict original_url to same-origin uploads/frenzy-mockups paths (reject otherwise), or require manage_woocommerce for remote fetch.

• medium Unauthenticated canvas save writes uploaded bytes without image validation

  file_access

  frenzy_handle_save_canvas_mockup (nopriv) accepts $_FILES[image] and move_uploaded_file into uploads/frenzy-mockups with a forced .png extension, without verifying MIME/content via wp_check_filetype_and_ext or getimagesize. Combined with a public nonce this allows anonymous write of arbitrary byte streams into the uploads tree (extension is png so PHP execution is unlikely on default configs).

  includes/mockup/handlers-save-canvas.php:13-33

  Recommendation

  Validate image contents (getimagesize / wp_check_filetype_and_ext) before move_uploaded_file; rate-limit nopriv uploads.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.