Medium-severity findings.

Audited release

1.0.7

Findings

2

Worst severity

medium

Content hash

9ee0aae40f4cfcdea34dc3d5… Copy

Findings

• medium Subscriber can create, IDOR-overwrite, and delete any saved Ajax Inspector request

  missing_capability

  wp_ajax_ajax_list, wp_ajax_ajax_list_save, and wp_ajax_ajax_list_remove are registered for any logged-in user with no current_user_can, check_ajax_referer, or wp_verify_nonce. ajax_save_list inserts with get_current_user_id() but, when id is non-zero, $wpdb->update() keys only on id — it does not require that row's user_id match the caller — so a Subscriber can overwrite another user's title/payload. ajax_list_remove $wpdb->delete()s by id alone. Inputs come from Request::get() which reads $_REQUEST, so a top-level GET (SameSite=Lax cookies sent) is a CSRF vector against a logged-in admin as well. ajax_list itself is scoped to the current user, so this is integrity not confidentiality. Observable effect: rows in {$wpdb->prefix}ajax_lists are created, silently replaced, or deleted; a poisoned payload is what the victim admin's Inspector will Send.

  src/Hooks/Ajax.php:21-101

  Recommendation

  Gate all three handlers with current_user_can('manage_options') and check_ajax_referer(). On update and delete, require AND user_id = get_current_user_id() (or a prepared WHERE with both id and user_id). Do not read mutation parameters from $_GET/$_REQUEST; accept POST only. Localize a dedicated nonce instead of only the core 'updates' nonce.

• medium Local file inclusion via unsanitized view parameter on the Ajax Inspector page

  file_access

  AdminMenu::show_ajax_page() is the manage_options menu callback. If view is present in $_REQUEST, Request::get('view') runs sanitize_text_field (which does not strip ../) and the result is concatenated as $this->view_dir . "/$view.php" then include_once'd after file_exists. An administrator (or a CSRF GET to admin.php?page=ajax&view=...) can traverse out of src/Views and include any filesystem .php file, e.g. view=../../../../../wp-config. Not reachable below manage_options: WordPress denies admin.php?page=ajax for Subscriber. Forced .php suffix blocks non-PHP reads; impact is in-process include of an attacker-chosen PHP file in the admin request.

  src/Hooks/AdminMenu.php:53-65

  Recommendation

  Allow-list view names (e.g. index-angular, index) or map them to hardcoded paths. Reject any view containing '..', '/', or '\\'. Do not concatenate request data into include paths. Keep the manage_options gate and add a nonce if view switching remains.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.