Telegram Bot Reply WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.2

Findings

2

Worst severity

medium

Content hash

bc96bef5b3686bd44a939bb0… Copy

Findings

• medium Settings save lacks CSRF nonce

  csrf

  option.php processes update_pluginoptions / update_tgbotwebhook / test_send from $_POST without wp_nonce_field or check_admin_referer. The options page is gated by administrator via add_options_page, but a logged-in administrator visiting a malicious page can have bot token, Telegram user id, and reply settings overwritten or webhook regenerated via CSRF.

  option.php:9-26

  Recommendation

  Add wp_nonce_field on the settings form and verify with check_admin_referer before updating options or calling Telegram setWebhook.

• medium Webhook authenticates only by Telegram user id, no secret token

  auth_bypass

  The runtime webhook (webhook_<SecertKey>.php created from webhook.php) loads wp-load.php and accepts php://input JSON. Authorization is only comparing message.from.id to tgbot_reply_tguser_id; there is no X-Telegram-Bot-Api-Secret-Token (or equivalent) check. Anyone who learns the URL can forge updates as that Telegram user and approve/delete comments or post replies as the configured WP user.

  webhook.php:14-37

  Recommendation

  Validate Telegram webhook secret token header; reject requests that fail. Keep the path secret as defense in depth only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.