Hip Elementor Addons WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ GitLab

High-severity findings.

Audited release

1.3.8

Findings

2

Worst severity

high

Content hash

d91408258d4f7c4eb6da247e… Copy

Findings

• high Subscriber+ can overwrite Maps API settings via nonce-only AJAX

  missing_capability

  wp_ajax_hip_additional_settings (save_additional_settings) and wp_ajax_hip_elements_settings (save_settings) are registered without wp_ajax_nopriv, so they require a logged-in user, but the only gate is check_ajax_referer('pa-settings-tab','security'). There is no current_user_can('manage_options') (the cap used for the settings menu). admin_enqueue_scripts enqueues hip-admin.js and localizes hipAddonsSettings.settings.nonce = wp_create_nonce('pa-settings-tab') on every admin screen with no $hook / capability check, so a Subscriber loading /wp-admin/profile.php receives a nonce that satisfies the AJAX. save_additional_settings parse_str()s POST fields and update_option('hip_maps_save_settings') with hip-map-api, hip-map-disable-api, hip-map-cluster, and hip-map-locale. That option is read in Addons_Integration::googleMapsJS (wp_footer on every frontend page) and interpolated into script.src as https://maps.googleapis.com/maps/api/js?key={api}&language={locale} without esc_js/esc_url. Observable consequence: any logged-in user can replace or blank the site's Google Maps API key and toggle API/cluster loading for all visitors. Quote-breakout XSS via hip-map-api is not counted as stored XSS here because wp_magic_quotes() slashes " and the handler never wp_unslash()s fields, so the JS string does not close; extra query parameters (e.g. &callback=) still land in the script URL. save_settings likewise writes pa_save_settings with no cap check; 1.3.8 never reads that option (widgets_register uses get_default_elements()), so that sibling action is the same missing gate with no consumer.

  admin/includes/admin-helper.php:80-81,160-187,328-377

  Recommendation

  Require current_user_can('manage_options') (and fail closed) in both AJAX handlers in addition to the nonce. Only enqueue and localize the nonce on the plugin settings screen. Escape the Maps API URL with esc_url() (or esc_js() inside the JS string) in googleMapsJS(). Restrict hip-map-locale to the known prefix list.

• medium Maps IP-location unserializes cleartext geoplugin output and fatals on X-Forwarded-For

  unsafe_unserialize

  When an editor enables the maps widget control premium_map_ip_location (return_value 'true'), Premium_Maps::render() on the public page trusts HTTP_X_FORWARDED_FOR, assigns it to REMOTE_ADDR, then unserialize(file_get_contents('http://www.geoplugin.net/php.gp?ip='.$ip_address)) with no allowed_classes restriction and no HTTPS. The serialized bytes come from geoplugin over HTTP (MITM between the WordPress host and geoplugin.net can instantiate PHP objects). Independently, the X-Forwarded-For branch calls filter_var_array() on a string (the header is never an array). On PHP 8+ that is an uncaught TypeError and a 500 for that request; any unauthenticated visitor (or a reverse proxy that always sets X-Forwarded-For, e.g. Cloudflare) can trigger it on every page that embeds the widget with Get User Location on. sanitize_text_field on the IP does not make the remote unserialize safe. Default widget state has the switcher off, so this is feature-gated, not default-on.

  widgets/premium-maps.php:947-960

  Recommendation

  Stop using unserialize on remote content; use the geoplugin JSON endpoint and json_decode(). Fetch over HTTPS via wp_remote_get(). Validate the IP with rest_is_ip_address() (or FILTER_VALIDATE_IP) and ignore X-Forwarded-For unless the site is known to sit behind a trusted proxy. If PHP 8 must keep a forwarded-for parser, explode the header string; do not pass it to filter_var_array().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.