Gitlab Trigger WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+ GitLab

High-severity findings.

Audited release

1.0.2

Findings

3

Worst severity

high

Content hash

408858a12c47052621d33e92… Copy

Findings

• high AJAX saveSettings lacks capability and nonce

  missing_capability

  wp_ajax_saveSettings inserts gitlab_token/brand_tag/project_id into the DB for any authenticated user with no current_user_can or nonce check. Subscribers can overwrite GitLab credentials used for pipeline triggers.

  wp-trigger-plugin.php:264-291

• high AJAX gitlabTriggerSubmit lacks capability and nonce

  missing_capability

  Any logged-in user can POST gitlab_token/project_id/ref to trigger a GitLab pipeline via curl. No manage_options or nonce. Also enables abuse of attacker-supplied tokens (SSRF-like side channel to gitlab.com).

  wp-trigger-plugin.php:327-371

• medium AJAX handlers missing CSRF nonces

  missing_nonce

  Neither saveSettings nor gitlabTriggerSubmit verify a nonce; admin UI JS posts without nonce fields.

  wp-trigger-plugin.php:145-203

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.