Medium-severity findings.

Audited release

2.1.0

Findings

1

Worst severity

medium

Content hash

6d431dcb19648caf7d413a5e… Copy

Findings

• medium GitHub plugin updater disables TLS verification and installs the response zipball_url

  insecure_config

  check_for_plugin_update() is hooked to pre_set_site_transient_update_plugins and, on every WordPress plugin-update check (wp-admin or wp-cron), calls wp_remote_get() against a hardcoded GitHub releases/latest URL with sslverify => false. The JSON tag_name is version_compare()'d against the installed header and zipball_url is copied verbatim into $transient->response[$plugin_slug]->package with no check that the URL is on api.github.com/github.com. WordPress core then downloads that package and WP_Upgrader overwrites this plugin's directory. The README tells operators to enable automatic plugin updates, so a successful MITM (rogue DNS, compromised middlebox, local HTTP proxy on a self-hosted shop) can ship arbitrary PHP without an administrator clicking Update. This is not a Subscriber-reachable HTTP handler and not unauthenticated WordPress RCE via a public endpoint; it is an insecure TLS default on the self-update channel whose consumer is plugin-file replacement. HTTP status is not checked before json_decode; a forged 200 body is enough. No secrets ride on the request.

  Persian-to-english-number-converter.php:84-113

  Recommendation

  Remove sslverify => false (WordPress defaults to true). Allowlist package URLs to https://api.github.com/ or https://github.com/hassan7303/Persian-to-english-number-converter/. Prefer a GitHub release asset with a pinned SHA-256 over zipball_url. Fail closed on non-200 responses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.