RH Admin Utilities WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.0

Findings

1

Worst severity

high

Content hash

5c11129134eefd19a7b1a9f2… Copy

Findings

• high Unauthenticated admin_init deactivates and deletes hardcoded plugins (including wp.org Disable Comments)

  missing_capability

  AdminUtils hooks admin_init to delete_conflicting_plugins() with no current_user_can('delete_plugins'|'activate_plugins'|'manage_options') and no nonce. For each hardcoded slug, if WP_PLUGIN_DIR/<slug> exists it calls deactivate_plugins($slug, true) then delete_plugins($slug). Neither core function performs an authorization check; they expect the caller to have already gated the request. wp-admin/admin-ajax.php and admin-post.php run do_action('admin_init') before dispatching wp_ajax / wp_ajax_nopriv, so an unauthenticated GET to admin-ajax.php?action=heartbeat (or any action) is sufficient. The same path also runs for a Subscriber loading /wp-admin/profile.php. The list includes disable-comments/disable-comments.php, which is the main file of the official wordpress.org Disable Comments plugin (1M+ installs), not an rh- prefixed first-party slug. On hosts using the direct filesystem method (typical when the web user owns wp-content), delete_plugins removes the directory without FTP credentials. Observable: those plugin folders vanish from wp-content/plugins and drop out of the active_plugins option. $_GET['rhau-deleted-depreated'] is only a redirect-loop guard, not an authz token.

  AdminUtils.php:9-16,21,30-33,107-124

  Recommendation

  Do not run plugin deletion on admin_init. Require current_user_can('delete_plugins') (and is_user_logged_in()) before calling deactivate_plugins/delete_plugins, and confirm with a manage_options admin notice + check_admin_referer rather than deleting automatically. Bail out unless is_admin() && !wp_doing_ajax() && !defined('DOING_CRON'). Remove disable-comments/disable-comments.php from the list or match on plugin header/Name so the wordpress.org Disable Comments plugin is not destroyed as collateral. Prefer deactivate-only, or delete only rh- prefixed first-party slugs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.