WPAdmin Notes WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.3

Findings

2

Worst severity

high

Content hash

b916b5fcd97dd856157dc256… Copy

Findings

• high Unauthenticated AJAX creates, updates, and force-deletes dashboard notes

  missing_auth

  inc/mdn-ajax-calls.inc.php registers mdn_save_note, mdn_update_note, and mdn_delete_note on both wp_ajax_ and wp_ajax_nopriv_ with no capability, ownership, or nonce check. mdn_save_note reads $_POST['data'] and calls wp_insert_post with post_status=publish and post_type=mdn_note. mdn_update_note / mdn_delete_note take an attacker-chosen ID, confirm only that get_post_type() is mdn_note, then wp_update_post or wp_delete_post($id, true). The intended model is per-author private notes (mdn_init_dashboard_widgets skips widgets where $user->ID != $note->post_author), but that check is not applied here, so any visitor can alter or permanently delete another user's notes. mdn_add_new_note is also nopriv and returns the next wp_posts Auto_increment, which makes ID discovery trivial. The main file's `if ( ! is_admin() ) return;` does not block this: admin-ajax.php defines WP_ADMIN before loading plugins, admin_init includes this file, then WordPress fires wp_ajax_nopriv_{action}. Observable: POST /wp-admin/admin-ajax.php with action=mdn_delete_note&noteId=N as a logged-out client removes that note from the owner's dashboard and from the posts table.

  inc/mdn-ajax-calls.inc.php:126-146

  Recommendation

  Drop every wp_ajax_nopriv_* hook for these actions. At the start of each handler call check_ajax_referer, current_user_can on an appropriate cap, and (for update/delete) verify get_post_field('post_author', $id) === get_current_user_id(). Do not call wp_insert_post / wp_update_post / wp_delete_post until those gates pass.

• high Unauthenticated AJAX returns arbitrary post content by ID

  information_disclosure

  mdn_update_form_content is registered on wp_ajax_nopriv_mdn_update_form_content and performs no login, capability, nonce, or post-type check. It absint()s $_POST['id'], loads get_post($id), and puts $post->post_content into a textarea and Markdown HTML in the JSON response (plus $post->post_title in the cancel-content delete confirm). get_post() ignores status, password, and capabilities, so a visitor who can iterate IDs (mdn_add_new_note leaks Auto_increment) can read draft/private/pending/password-protected posts, other users' mdn_note bodies, and any other post type that stores secrets in post_content. The dashboard JS only requests note IDs, but the endpoint itself has no such restriction. Observable: unauthenticated POST action=mdn_update_form_content&id=<n> returns that post's raw body in rsp.html.

  inc/mdn-ajax-calls.inc.php:255-271

  Recommendation

  Require a logged-in user, a nonce, current_user_can, post_type === 'mdn_note', and post_author === current user before calling get_post. Escape textarea content with esc_textarea(). Do not register this action on wp_ajax_nopriv_*.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.