Archery Logbook Integration WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.8

Findings

2

Worst severity

high

Content hash

f6811acfab411f96e273ab4f… Copy

Findings

• high Authenticated AJAX API proxy lacks capability and nonce checks

  missing_capability

  wp_ajax_archery_logbook_send_request and wp_ajax_archery_logbook_get_data are reachable by any logged-in user (including Subscriber). Handlers accept attacker-controlled path, method, and JSON body, sign requests with the site-stored Archery Logbook access key/secret, call the configured API URL, and return the raw response. Front-end shortcode JS posts to admin-ajax.php without a nonce. A low-privilege account can abuse stored secrets to read/modify remote logbook data and probe the configured host (SSRF-style path concatenation on $url.$path).

  archery-logbook.php:218-310

  Recommendation

  Require a capability appropriate to the shortcodes (e.g. edit_posts or a custom cap), verify a nonce localized only for authorized users, allowlist paths/methods, and never echo unsanitized remote responses into HTML contexts.

• medium Outbound API client disables TLS certificate verification

  insecure_config

  Archery_Logbook_Integration::send_request sets CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to false, enabling MITM against the API traffic that carries access keys and archer PII.

  class-archery-logbook-integration.php:44-45

  Recommendation

  Enable peer/host verification by default; only disable behind an explicit admin opt-in for lab environments.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.