Converttize WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.6

Findings

3

Worst severity

high

Content hash

2eeab37487f65d658d60266b… Copy

Findings

• high Hardcoded license/security secret in plugin source

  hardcoded_credentials

  The string CONV_SEC_2024_XYZ789 is hard-coded and used to mint security_hash / security_token values consumed by nopriv analytics. Any visitor who views frontend JS or the plugin package can forge valid tokens for lumeplayer_save_analytics and related checks.

  converttize.php:1146-1152

  Recommendation

  Move the secret to a site-specific option or wp-config constant generated at install; rotate and stop shipping a shared default.

• medium License cache clear AJAX lacks capability check

  missing_capability

  wp_ajax_converttize_clear_cache_admin verifies only a nonce then clears license cache options. Any authenticated user who obtains the admin-page nonce (or via CSRF against an admin) can disrupt licensing.

  includes/class-license-manager.php:465-472

  Recommendation

  Require current_user_can('manage_options') before clearing cache.

• medium Unauthenticated view-log AJAX with no nonce

  missing_auth

  yt_save_view_data is registered for nopriv and inserts attacker-controlled video_id/watched_time into yt_view_logs with no nonce or capability check, enabling analytics table flooding (DoS).

  includes/class-analytics.php:5-25

  Recommendation

  Require a nonce/token, rate-limit, and reject excessive inserts.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.