Medium-severity findings.

Audited release

1.2.0

Findings

1

Worst severity

medium

Content hash

435e1e4fa50223f3a9342fd5… Copy

Findings

• medium Tinker SQL log written to a web-accessible plugin tmp/query.json with no access control

  information_disclosure

  Every snapcode_output invocation calls empty_tmp_files(), which mkdir()s SNAPCODE_DIR/tmp at 0755 and seeds tmp/query.json. During eval, add_filter('log_query_custom_data', TinkerController::log_wp_query) appends each query string and query_time onto that file via file_put_contents. The directory is inside the plugin folder (normally served as /wp-content/plugins/snapcode/tmp/) and the plugin ships no index.php, .htaccess, or equivalent. After an administrator (or the Subscriber RCE in finding 1) runs a snippet, an unauthenticated GET of tmp/query.json returns the last run's SQL — including whatever the operator selected or dumped (wp_users, options, post_content). The file is only truncated to [] at the start of the next tinker call, so it remains world-readable between uses. tmp.txt is also created but is emptied on each run; get_output_by_cmd (which would write PHP into tmp.txt) is not called from get_output.

  src/Controllers/TinkerController.php:104-111,302-318

  Recommendation

  Do not store query logs under a URL-reachable plugin directory. Use a directory outside the web root, or wp_upload_dir() based paths protected with an index.php plus Apache/nginx deny rules, or keep the log in a non-public option/transient and delete it after the AJAX response. Never persist raw SQL from a REPL to a guessable public path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.