Reclaim WP Registry grade F. Critical findings · 5 findingsWP RegistryCritical findings · 5 findingsOpen the reportF #10 in Social & Sharing

Critical findings.

Audited release

0.1

Findings

5

Worst severity

critical

Content hash

7e78103009d255db2c844505… Copy

Findings

• critical Subscriber-level SSRF in Instagram resync AJAX imports attacker JSON into published posts, giving stored XSS via [embed_code]

  xss_stored

  Each module registers wp_ajax_<mod>_resync_items with no capability check and no nonce, so any logged-in user (Subscriber) can call it. instagram_reclaim_module::ajax_resync_items() takes $_POST['next_url'] verbatim and fetches it with wp_remote_get (SSRF). The JSON response is passed to map_data()/construct_content(), which concatenates $entry['link'] unescaped into an <iframe src="..."> embed_code string. insert_posts() then calls wp_insert_post with post_status 'publish' and saves that string as the 'embed_code' post meta. The [embed_code] shortcode returns get_post_meta(...,'embed_code') with no escaping. Post meta is not kses-filtered, so a link value like '"><script>...</script>' runs on the public front end for every visitor and any admin who views the post. Precondition: the Instagram module is active and has instagram_user_id/instagram_access_token set. Facebook, Flickr, Google+, Moves, Vine and YouTube take the same unvalidated next_url, so the SSRF also applies to them.

  mods/instagram.class.php:224-252, 380-400

  Recommendation

  Require current_user_can('manage_options') and check_ajax_referer() in every ajax_* handler. Never fetch a client-supplied next_url (rebuild pagination server-side or limit it to the provider host). Escape all imported fields (esc_url/esc_attr) and run embed_code through wp_kses before storing or rendering it.

• high Unauthenticated / CSRF destructive admin actions via is_admin() check in constructor (delete all imported posts, reset, resync)

  missing_auth

  reclaim_core::__construct() runs on init. If is_admin() is true and $_REQUEST['<mod>_remove_posts'], '<mod>_reset' or '<mod>_resync' is set, it immediately calls removePostsMod/resetMod/updateMod. There is no capability check and no nonce. is_admin() is also true for /wp-admin/admin-ajax.php and admin-post.php, including requests from unauthenticated visitors. So anyone can send GET /wp-admin/admin-ajax.php?twitter_remove_posts=1 (or any active module name). remove_posts() force-deletes every post generated by that module, plus their attachments, permanently ($force_delete = true). It can also reset sync state or start expensive remote imports.

  reclaim.php:64-82

  Recommendation

  Move these actions to admin_post_* handlers that require current_user_can('manage_options') and check_admin_referer().

• high [embed_code] shortcode renders unprotected post meta unescaped (Contributor stored XSS)

  xss_stored

  The embed_code meta key is not underscore-protected. Any user who can edit a post (Contributor and up) can set it through the Custom Fields UI or add_meta, then put [embed_code] in the post. The shortcode returns do_shortcode(get_post_meta($post_id,'embed_code',true)) with no kses or escaping. Script then runs when an editor or admin previews the post, or on the front end once it is published.

  reclaim.php:416-423

  Recommendation

  Store embed codes under a protected key (_reclaim_embed_code) and run output through wp_kses with an iframe allowlist.

• medium Publicly readable log file in plugin directory records API URLs containing access tokens

  information_disclosure

  reclaim_module::log() appends to RECLAIM_PLUGIN_PATH/reclaim-log.txt inside the web-accessible plugin folder. import_via_curl() logs 'error while loading '.$apiurl on any HTTP error. Those URLs carry instagram_access_token, facebook_oauth_token, foursquare/moves access tokens and the google_api_key. Anyone can fetch /wp-content/plugins/reclaim/reclaim-log.txt and harvest the site owner's social API tokens.

  mod.class.php:220-224, 409-411

  Recommendation

  Write logs outside the web root (or to error_log) and strip tokens and keys from logged URLs.

• medium Direct-access hybridauth_helper.php is an unauthenticated open redirect

  unsafe_input

  helper/hybridauth/hybridauth_helper.php can be requested directly and does not load WordPress. It takes $_REQUEST['callbackUrl'], urldecodes it, and redirects to it with header('Location: ...') in both the success and failure branches. Nothing validates the URL, so attackers can use the site's domain to bounce victims to phishing pages.

  helper/hybridauth/hybridauth_helper.php:19-37, 67-98

  Recommendation

  Route the OAuth flow through WordPress, validate callbackUrl with wp_validate_redirect() against admin_url(), and block direct access.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.