Envato Market WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB #6 in Updates & Deployment

Medium-severity findings.

Audited release

2.0.7

Findings

2

Worst severity

medium

Content hash

0fe2ac892903678034650754… Copy

Findings

• medium AJAX item add/remove and healthcheck lack current_user_can (nonce only)

  missing_capability

  wp_ajax_envato_market_add_item, wp_ajax_envato_market_remove_item, and wp_ajax_envato_market_healthcheck are registered for every logged-in user. Each handler's only gate is check_ajax_referer('envato_market', 'nonce'); there is no current_user_can('manage_options') or install_plugins/install_themes. ajax_add_item then sends $_POST['token'] to api.envato.com, stores the token and item id in option envato_market, and rebuilds the theme/plugin update caches. ajax_remove_item deletes matching items from that option. ajax_healthcheck returns php.ini limits, WP_DEBUG, filesystem method, upload-dir writability, and Envato API token scopes. Upstream 2.0.11 changelog: 'Enhance AJAX calls with additional current_user_can security checks' (install_themes && install_plugins on add/healthcheck; delete_plugins && delete_themes on remove). On a default role map this plugin only localizes the nonce on the manage_options admin page, so Subscriber/Customer/Editor cannot scrape _envatoMarket.nonce from this plugin's UI and the nonce check will fail them; the missing capability is still a real authorization gap (nonce is CSRF, not auth) and is the 2.0.11 security fix.

  inc/admin/class-envato-market-admin.php:1173-1184

  Recommendation

  Backport the 2.0.11 checks: after the nonce/method tests, require current_user_can('install_themes') && current_user_can('install_plugins') on add_item and healthcheck, and current_user_can('delete_plugins') && current_user_can('delete_themes') on remove_item (or simply manage_options to match the menu). Reject and 403 otherwise. Prefer get_site_option/set_options consistently when network-activated so ajax_add_item cannot clobber the network token.

• low Inverted nonce check on init allows unauthenticated deletion of Envato update transients

  csrf

  maybe_delete_transients is hooked to init (priority 11) and therefore runs on every front-end and admin request, including unauthenticated ones. If $_POST['envato_market'] is set, it only wp_die()s when _wpnonce is present AND wp_verify_nonce fails. Omitting _wpnonce skips the check and always calls delete_transients(), which deletes site transients envato_market_themes and envato_market_plugins. Any origin can CSRF this with a simple POST (no cookies required). Blast radius is a cache reset: the next admin settings view or core update check rebuilds those lists via the Envato API (extra API traffic / delayed update cards), not code execution. The same inverted check is still present in later upstream (2.0.14). There is also no current_user_can.

  inc/admin/class-envato-market-admin.php:280-288

  Recommendation

  Fail closed: if ( ! isset($_POST['_wpnonce']) || ! wp_verify_nonce(...) ) { return; } and require current_user_can('manage_options') before delete_transients(). Do not run this on public init for anonymous POSTs; keep it on the settings-save path only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.