Gravity Extract WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.1

Findings

3

Worst severity

high

Content hash

0484aa8a813c3e46cc7446d0… Copy

Findings

• high Unauthenticated AJAX upload writes files without form, field, or type checks

  file_access

  wp_ajax_nopriv_gravity_extract_upload_file maps to Gravity_Extract::ajax_upload_file. The only gate is check_ajax_referer('gravity_extract_frontend'), whose nonce is localized on any public Gravity Form that contains a gravity_extract field and is not bound to a form_id. form_id and field_id are optional integers; wp_handle_upload($file, array('test_form' => false)) runs before any GFAPI::get_form / field-type check, and no mimes/allowedExtensions allowlist is passed (the field UI advertises jpg/png/webp/pdf and a 10MB cap, but those exist only in JavaScript). WordPress then accepts the full get_allowed_mime_types() set (documents, audio, video, archives, etc.). Success JSON includes both the public uploads URL and the absolute server path. application/pdf uploads are converted with Imagick::readImage($pdf_path . '[' . $i . ']') (up to 10 pages at 150 DPI, memory_limit raised to 512M) — untrusted PDFs processed by Ghostscript/ImageMagick. Uploaded files are never attached as media, never moved into Gravity Forms' hashed directory, and are not deleted if the visitor never submits the form, so a scraped uid-0 nonce enables unlimited public-file planting and disk fill for 12–24 hours.

  includes/class-gravity-extract.php:489-565

  Recommendation

  Reject the request unless form_id/field_id resolve to a published form whose field type is gravity_extract. Bind the nonce to the form (or include a per-form token). Pass an explicit mimes map matching the field's allowedExtensions (default jpeg/png/webp/pdf) into wp_handle_upload, enforce a server-side size cap, and do not return the filesystem path. Store files in a non-listable Gravity Forms-style hashed directory. Rate-limit by IP. Treat uploaded PDFs as untrusted (disable Imagick if possible; at least limit pages/pixels and fail closed).

• high Unauthenticated analyze endpoint spends any form's stored AI API keys

  dos

  wp_ajax_nopriv_gravity_extract_analyze (and the upload handler's post-upload analysis branch) is reachable with the same global gravity_extract_frontend nonce. After the nonce check, the handler takes attacker-controlled form_id/field_id/image_base64, loads the form via GFAPI::get_form (works for inactive/non-embedded forms), and reads gravity_extract_api_key / gravity_extract_gemini_api_key plus the model from that form's add-on settings. There is no current_user_can, no check that the form is publicly embeddable, no binding of the nonce to form_id, no rate limit, and no cap on image_base64 size. The image is then POSTed to https://api.poe.com/v1/chat/completions or https://generativelanguage.googleapis.com/v1beta/openai/chat/completions using the site owner's secret. A visitor who loads any public form that merely contains a gravity_extract field can enumerate form_id/field_id and burn every configured form's POE/Gemini quota (and PHP memory) without submitting an entry.

  includes/class-gravity-extract.php:393-484

  Recommendation

  Bind the frontend nonce (or a second token) to form_id. Refuse analysis unless that form is currently displayed/published and the field is gravity_extract with mappings. Rate-limit per IP and per form, reject oversized base64, and do not raise memory_limit for unauthenticated requests. Keep API keys server-side (already done) but treat each key as scoped to its form.

• medium Entry save always dumps full form POST to the PHP error log

  information_disclosure

  GF_Field_Gravity_Extract::get_value_save_entry runs on every Gravity Forms submission that includes this field. Seven error_log() calls are unconditional (not gated on WP_DEBUG), including print_r($_POST, true). Mapped extraction fields are designed to hold invoices, VAT numbers, and bank_IBAN / bank_BIC values; those plus other GF inputs and nonces are therefore written to the PHP error log on every submit. On many hosts error_log is a web-reachable file (public_html/error_log or wp-content/debug.log). The same method also returns rgpost('input_{id}_file') without esc_url_raw/parent::sanitize_entry_value, so the stored value is whatever the submitter posted, but the immediate observable harm is PII/secret leakage into logs. convert_pdf_to_jpeg() and the POE/Gemini analyze_image_with_keys() helpers likewise error_log without a WP_DEBUG guard.

  includes/class-gf-field-gravity-extract.php:176-189

  Recommendation

  Remove leftover debug logging from production paths. If logging is needed, gate it on WP_DEBUG and never print $_POST or file contents. Sanitize the saved file value with esc_url_raw() (and verify it matches a file this request actually uploaded). In get_value_merge_tag, honor $esc_html / $url_encode instead of returning the raw stored string.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.