Medium-severity findings.

Audited release

0.3.1

Findings

1

Worst severity

medium

Content hash

ed44a0fb04a3cf498cb29940… Copy

Findings

• medium Request-driven callable proxy with empty-allowlist default (eval-by-design)

  eval_by_design

  EasyAjax\Front::register() takes the AJAX action from the request and EasyAjax\Proxy::get_callable() resolves it to a PHP function, Class::method, new Class()->method, or $GLOBALS[class]->method. Front::setup only rejects actions when $allowed is non-empty; empty allowlist (the easyajax() default) permits all. Proxy::allowed() applies filter easyajax_allowed with default 1. Auth is only wp_verify_nonce(eanonce, __FILE__), and that nonce is localized to every page via easy_ajax_vars when the helper is bootstrapped. The plugin itself does not call easyajax() on load, so a default install is inert until theme/plugin code enables it — but the shipped API is designed for arbitrary dispatch.

  src/EasyAjax/Proxy.php:85-177

  Recommendation

  Require a non-empty allowlist; default easyajax_allowed to false; never register nopriv for arbitrary callables; map actions to explicit callbacks instead of reflecting on request strings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.