High-severity findings.

Audited release

1.0.0

Findings

3

Worst severity

high

Content hash

584e45387549334d89cf98e4… Copy

Findings

• high Session recordings are web-reachable; list/download APIs only check a GET secret

  missing_auth

  Nicen_Replay_response runs on plugins_loaded for every front-end request. nicen_replay_event has no authentication and FILE_APPENDs base64-decoded bodies to nicen_replay_path/events/{nicen_replay_plugin_private}/{Y-m-d}/{ip}.txt (mkdir 0777). That directory is inside the plugin webroot; events/ contains only a .gitignore (no index.php, no .htaccess deny). The folder name is the same value stored in option nicen_replay_plugin_private, which auth() compares with loose != against $_GET/$_POST['private']—there is no current_user_can, is_user_logged_in, or nonce. admin/render.php then loads the world-readable static file response/player.html?api={site_url}&private={secret} in an iframe, and the CDN player posts that secret back to /?nicen_replay_get_all_logs=1 and /?nicen_replay_get_event=1. On any host that lists directories (or once the player URL/access logs leak), an unauthenticated client learns the secret, downloads every visitor's rrweb log as a static .txt (bypassing even json_decode), and calls the list/download APIs with no WordPress session. Recordings include form field values from the public site (login identifiers, checkout/address fields; rrweb masks type=password only). The secret itself is md5(time().rand(0,9999)), not a CSPRNG.

  response/api.php:15-18,182-191

  Recommendation

  Store recordings outside the document root (or deny HTTP to events/ with nginx location + Apache .htaccess + index.php). Authenticate list/download with current_user_can('manage_options') plus a POST nonce; do not put the API secret in GET URLs or directory names. Generate nicen_replay_plugin_private with wp_generate_password() / random_bytes() and never echo it into a publicly reachable player.html. Serve the player from an admin-only PHP wrapper.

• medium get_event/get_all_logs path traversal via date/file/ip JSON fields

  file_access

  After auth() succeeds, nicen_replay_get_event builds $file_path = $this->root . $date . '/' . $file using sanitize_text_field() on php://input JSON. sanitize_text_field does not strip ../, and there is no realpath/str_starts_with confinement to $this->root. POST date=../../../../..& file=composer.json (or any other on-disk JSON document) causes file_get_contents of files outside the events tree; each line is json_decode'd and returned. nicen_replay_get_all_logs concatenates the same $date and $ip into glob(), so date=../.. or date=* lists plugin/PHP files and other users' logs. php://input bypasses wp_magic_quotes. Impact is limited to files that json_decode (wp-config.php lines become nulls) and requires the private key, which finding 1 shows is not equivalent to a manage_options session.

  response/api.php:206-257

  Recommendation

  Resolve realpath($file_path) and reject unless it is inside realpath($this->root). Use basename() on $file, allowlist $date as /^\d{4}-\d{2}-\d{2}$/, and treat $ip as a literal filename (no glob metacharacters).

• medium Unauthenticated event endpoint appends unbounded data into 0777 webroot files

  dos

  POST /?nicen_replay_event=1 is reachable by anyone (no capability, nonce, origin check, size cap, or rate limit). The client-chosen JSON ip is sanitize_file_name'd and becomes the log filename, so an attacker can append into another visitor's YYYY-MM-DD/{ip}.txt and poison the admin replay. events is base64_decode'd and FILE_APPENDed as-is; mkdir(..., 0777, true) creates world-writable date folders under the plugin directory. Observable consequence is disk exhaustion (WordPress can no longer write) plus contaminated session files the administrator then opens in player.html. This is the intended beacon, but without quotas it is an unauthenticated write sink in a web-reachable path.

  response/api.php:120-166

  Recommendation

  Keep the beacon public if needed, but write outside the document root with 0750 dirs, cap body size, rate-limit per IP, bind the filename to a server-derived ID rather than client-supplied ip, and reject non-JSON payloads after decode.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.