RH Login WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

0.3.6

Findings

2

Worst severity

medium

Content hash

7d8a37b75d00a15d8222beb5… Copy

Findings

• medium Hide-login rewrites the public post-password form onto the secret path

  information_disclosure

  When Login-URL verstecken is enabled, filterUrl rewrites every site_url or network_site_url that contains the substring wp-login.php to home_url('/{secret}'), preserving the query string. Core get_the_password_form() builds the form action with site_url('wp-login.php?action=postpass'). Any anonymous visitor who can view a password-protected post, or its content in the RSS/Atom feed via get_the_content_feed(), therefore receives the hidden login path in HTML. Opening that path runs serveLogin() and loads wp-login.php. This is unnecessary: intercept() already returns early for an exact action=postpass request (without key or checkemail), so the real wp-login.php?action=postpass endpoint still sets the post-password cookie. The rewrite defeats the secrecy 0.3.4 and 0.3.5 tried to restore for canonical and alias leaks. It does not skip the password check or the attempt limit. Deliberate login and logout links are a separate, intended disclosure so those flows keep working.

  inc/HideLogin.php:134-144

  Recommendation

  Do not rewrite URLs whose action is exactly postpass; leave those on wp-login.php, which is already allowlisted. Only rewrite wp_login_url, logout, reset, and register flows that must hit the secret path.

• low Login lockout counter loses updates under parallel failures

  auth_bypass

  recordFailure() reads the per-IP transient and writes current+1 in two steps, once per request (the $counted flag correctly suppresses the double hook from wp_login_failed and application_password_failed_authentication). enforceLockout() allows the attempt when the stored value is still below max_attempts, and the password check at authenticate priority 20 runs before this increment. Concurrent failed logins from one IP can all observe the same count and all write the same next value, so a parallel client exceeds the configured cap by roughly the concurrency times the threshold before the lockout sticks. Impact is extra password guesses against the rate limit, not an authentication bypass and not unlimited guesses. WordPress XML-RPC system.multicall does not multiply this further: after one failed wp_xmlrpc_server::login(), auth_failed short-circuits later calls in that request.

  inc/Login.php:131-140

  Recommendation

  Increment the counter atomically (for example a single SQL UPDATE of the transient option, or an object-cache increment) and reject the attempt when the pre-increment value is already at the cap.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.