OERSI WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ GitLab

High-severity findings.

Audited release

1.3.4

Findings

2

Worst severity

high

Content hash

c518f8af504150c0a2beabac… Copy

Findings

• high Public REST discloses Elasticsearch credentials

  information_disclosure

  ElasticsSearchRestAPI registers GET endpoint elasticssearch with permission_callback __return_true and returns get_option('oersi_plugin_elasticsSearch') unmodified. That option includes the credentials field (API token) configured in admin, enabling anonymous theft of search-backend secrets.

  inc/Pages/ElasticsSearch/ElasticsSearchRestAPI.php:70-95

  Recommendation

  Require manage_options for this route, or strip credentials from the public response and serve only non-secret client config.

• medium Configuration REST issues wp_rest nonce to anonymous callers

  information_disclosure

  ConfigurationAPI GET configuration is public and embeds wp_create_nonce('wp_rest') plus full plugin configuration in the JSON body, expanding CSRF/session fixation surface for any later cookie-authenticated browser session that consumes the page.

  inc/Pages/Configuration/ConfigurationAPI.php:72-117

  Recommendation

  Do not mint authenticated REST nonces for anonymous responses; gate admin config behind capability checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.