WPGraphQL CORS WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB-

Medium-severity findings.

Audited release

2.1

Findings

3

Worst severity

medium

Content hash

921341ec9cb6dc96e5fb0b50… Copy

Findings

• medium Block-unauthorized-domains origin gate is dead because of PHP operator precedence

  auth_bypass

  The plugin documents a "Block unauthorized domains" checkbox (acao_block_unauthorized) that is supposed to refuse GraphQL operations whose Referer/Origin is not on the allowlist. wpgraphql_cors_api_authentication implements that by throwing a GraphQL UserError, but the condition is `$allowed_origin == null && ! 'on' === get_graphql_setting(...)`. Unary `!` has higher precedence than `===`, so this evaluates as `($allowed_origin == null) && (false === 'on'|'off')` and is never true. PHP confirms the throw is unreachable for both 'on' and 'off'. The sibling header filter still changes Access-Control-Allow-Origin (wildcard vs siteurl), which only affects whether foreign JavaScript can read the body. The GraphQL operation itself still runs for any Origin, including omitted Origin (curl/Postman). That is the only server-side origin firewall; prefix matching in wpgraphql_cors_get_allowed_origin (HTTP_REFERER preferred over HTTP_ORIGIN, substr prefix after stripping the scheme) is therefore never backed by a reject. Downstream: with Send-site-credentials / loginWithCookies enabled, unauthorized-origin POSTs still execute cookie-authenticated work; even without cookies, the advertised API lock does not apply.

  includes/process-request.php:155-163

  Recommendation

  Compare with explicit parentheses and the same sense as the header helper: `if ( null === $allowed_origin && 'on' === get_graphql_setting( 'acao_block_unauthorized', 'off', 'graphql_cors_settings' ) ) { throw ... }`. Prefer the Origin header (not Referer) and parse_url host+scheme+port equality instead of scheme-stripped prefix matching. Do not treat CORS headers as a substitute for refusing the operation.

• medium Public logout mutation calls wp_logout() with no nonce or origin check

  csrf

  When graphql_cors_settings.logout_mutation is enabled (README presents this as the way to build a frontend logout button), register_graphql_mutation('logout') exposes a RootMutation with empty inputFields. mutateAndGetPayload ignores the GraphQL viewer and always calls wp_logout(), which destroys the current session and emits expired AUTH / logged_in Set-Cookie headers. There is no wp_verify_nonce, no capability check, and no Origin allowlist check inside the resolver. The plugin’s only origin reject (wpgraphql_cors_api_authentication) never fires, so a third-party site can POST mutation { logout(input:{}) { status } } to /graphql. wp_clear_auth_cookie does not require the request to have been authenticated: it blindly expires the WordPress cookie names. With loginWithCookies (default samesite_mode None) the browser also sends the session on cross-site fetch; even with Lax cookies, a top-level form POST is a first-party navigation whose Set-Cookie response can still clear the session. Core wp-login.php?action=logout requires a nonce; this mutation does not.

  includes/logout-mutation.php:16-41

  Recommendation

  Before wp_logout(), require a logged-in user and a CSRF token (WP nonce in a custom header, or a same-site cookie double-submit) and refuse the mutation when wpgraphql_cors_get_allowed_origin() is null. Do not clear auth cookies for unauthenticated or unauthorized-origin requests. Keep logout_mutation off unless those checks exist.

• low Plugin header, constant, and readme versions disagree

  version_mismatch

  The Plugin Name header Version is 2.1, WPGRAPHQL_CORS_VERSION is hardcoded to 1.1.1, readme.txt Stable tag is 1.1.0, and the GitHub tag/distribution is 2.1.1. WP admin, inventory, and any update check that reads the header will misidentify the installed code. The mismatch is unchanged on upstream master.

  wp-graphql-cors.php:8-26

  Recommendation

  Set the plugin header Version, WPGRAPHQL_CORS_VERSION, and readme.txt Stable tag to the same value as the git tag (2.1.1) and keep them in lockstep on future releases.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.