WordCamp Pontevedra 2022 WP Registry grade D-. Critical findings · 1 findingWP RegistryCritical findings · 1 findingOpen the reportD-

Critical findings.

Audited release

1.0.2

Findings

1

Worst severity

critical

Content hash

9f7fc0f1dc6c6d5e2e0a9302… Copy

Findings

• critical Hardcoded GitHub personal access token in plugin source

  hardcoded_credentials

  pontewordcamp.php embeds a live-looking GitHub PAT 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 in the updater config. Ponte_WordCamp_Updater sends it as Authorization: token … and also appends access_token= to zipball_url query strings (which can leak via Referer/logs). Anyone who installs or reads the plugin gains that credential and can access whatever repos/scopes the token still has. Observable: token string present in distributed PHP.

  pontewordcamp.php:34-37

  Recommendation

  Revoke the token immediately. Load secrets from environment/wp-config constants never committed to the plugin zip. Prefer public release assets without a PAT.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.