gEditorial WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

3.35.1

Findings

2

Worst severity

high

Content hash

938437e488a62a098cfb4280… Copy

Findings

• high Contributor+ can import, export, or delete all gEditorial options via Tools

  missing_capability

  The autoloaded Config module registers tools.php?page=geditorial-tools with capability editorial_tools. map_meta_cap maps that to edit_posts (Contributor/Author/Editor). Config resets $caps to [] so cuc('tools') is also editorial_tools/edit_posts. Visiting the page as Contributor renders tools_sub, which always opens a multipart form and prints a nonce (geditorial-general-tools) before render_tools_html. The UI then hides the dangerous cards behind current_user_can('manage_options') / edit_others_posts, but admin_tools_load() on POST sub=general only calls nonce_check — no manage_options. Tablelist::isAction('import_all_options') runs WordPress\Media::handleImportUpload() (wp_handle_upload with test_type false; no upload_files check) and update_option('geditorial_options', ...) with the JSON. download_all_options / download_active_options stream the option to the browser. delete_all_options calls delete_option with no super-admin check (the UI only shows that button to super admins). Observable as Contributor: GET tools.php?page=geditorial-tools, scrape the nonce, POST import_all_options with a JSON body that enables arbitrary modules and overwrites settings (including Remoted remote_token and restapi_restricted), or POST download_all_options / delete_all_options. Plugin::init_modules reads that option to decide which modules load.

  includes/Modules/Config/Config.php:17-27,170-188,497-567,676-710

  Recommendation

  Gate admin_tools_load POST actions with current_user_can('manage_options') (and keep delete_all_options as super-admin only). Register the Tools submenu with editorial_settings/manage_options, or restore Config::$caps['tools'] to manage_options so cuc('tools') and the menu cap match the UI. Do not emit a valid tools nonce on a page that Contributors can open.

• high Dead Drops secret URL lets anyone mint a REST identity for an arbitrary user

  auth_bypass

  When the Dead Drops module is enabled (beta; GEDITORIAL_BETA_FEATURES defaults TRUE; not autoloaded), an editor creates a capability URL /{permalink}/deaddrop/{24-char-secret}?u={editor_id}. template_redirect compares the path secret to post meta _deaddrop_secret, then takes user ID from attacker-controlled ?u= (fallback gEditorial()->user()) and renders a Dropzone page whose REST URL is /wp-json/wp/v2/media?post={id}&author={u}&dropzone={phpass hash of secret|user|post|salt}. determine_current_user, on REST only, re-reads author/post/dropzone from the request, loads the same secret, and if the hash verifies returns (int)$author with no capability check and no binding that author must be the editor who created the drop. Anyone who has the secret (it is in the shared URL) can request ?u=1 (or any upload-capable user), receive a hash for that user, and POST wp/v2/media. WordPress rest_cookie_check_errors does not verify X-WP-Nonce when no auth cookie was used, so the impersonated user remains current; media create_item then runs as that user. Observable: open the drop URL with u set to an administrator who can upload_files, upload an attachment authored as that administrator onto the target post.

  includes/Modules/DeadDrops/DeadDrops.php:175-266,366-389

  Recommendation

  Bind the drop secret to a single intended user at creation time (store user_id in post meta; ignore ?u=/author). Mint the hash only for that stored user. On determine_current_user, require the request author to equal the stored user and still restrict the impersonation to creating attachments on that one post (and consider a custom REST endpoint with an allowlist of mime types instead of reusing /wp/v2/media as the target user). Do not let visitors pick an arbitrary WordPress user to impersonate.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.