Central Hall WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB-

Medium-severity findings.

Audited release

1.1.3

Findings

3

Worst severity

medium

Content hash

053cb85c4894c097dea46b3e… Copy

Findings

• medium Hardcoded default guest password authenticates the public guest AJAX endpoint

  hardcoded_credentials

  Webhook registers wp_ajax_nopriv_indyhall_central_hall_guest on Webhook::guest with no nonce or capability check. guest() reads name/password/mac_address/host from $_REQUEST and compares password with == against Plugin::getOption('guest_password', Plugin::DEFAULT_GUEST_PASSWORD). DEFAULT_GUEST_PASSWORD is the literal string 'cowork with me'. The plugin never writes the guest_password option (Settings::registerSettings is an empty FIXME; the only override is defining INDYHALL_CENTRAL_HALL_GUEST_PASSWORD). On match it INSERT-logs the guest and returns JSONP {ok:true}. The bundled Angular AuthService treats ok===true as permission to submit the hidden pfSense #auth-form (action=$PORTAL_ACTION$), so the well-known default is a network-access credential on the intended deployment and, on any install, an unauthenticated writer into wp_{prefix}indyhall_central_hall_guest_log and _connection_log (admin 'Recent Connections' plus unbounded row growth). MAC is hex-validated; name/host are unsanitized but parameterized.

  lib/IndyHall/CentralHall/Webhook.php:96-141

  Recommendation

  Do not ship a working default guest password. Fail closed until an administrator sets a password (wp-config constant or a manage_options setting with a nonce). Hash-compare the secret, require POST, and rate-limit. Rotate any site still using 'cowork with me'.

• medium JSONP member/guest login puts passwords in GET and returns roles and device MACs to any origin

  information_disclosure

  wp_ajax_nopriv_indyhall_central_hall_login and _guest always finish in _respondAndExit, which requires a JavaScript identifier callback and then echoes $callback({json_encode($data)}). The portal AuthService calls $http.jsonp(loginUrl+'&callback=JSON_CALLBACK', {params: d}), so username, password, mac_address, and device_name travel on the query string (access logs, proxies, Referer, history). On wp_authenticate success, login() update_user_meta()s indyhall_central_hall_mac_addresses with attacker-supplied device_name and JSONP-returns user id, display_name, roles, and the full MAC map. The callback regex is tight enough to block XSS, but JSONP is readable from any origin: an attacker's page can stuff credentials and learn whether they hit an administrator and which MACs are registered. This does not mint a WP auth cookie (no wp_signon/wp_set_auth_cookie); the extra blast versus wp-login.php is cross-origin result-reading, GET password leakage, and the MAC meta write. Guest success also echoes the submitted password inside guest: $validated.

  lib/IndyHall/CentralHall/Webhook.php:26-94,216-237

  Recommendation

  Replace JSONP with POST + CORS allowlisting the pfSense portal origin (or a same-origin proxy). Never put passwords on the query string. Do not return roles or the full MAC inventory to the portal; return a boolean and a display name. Rate-limit wp_authenticate on this action. Keep MAC registration behind an authenticated, non-GET flow.

• medium No upstream maintenance path (last code 2014)

  abandoned_plugin

  This tree is GitHub tag v1.1.3 (release 2014-10-28). indyhall/central-hall last push is 2014-10-28 (42 commits, 0 forks, 1 star, not archived). The header documents GitHub Plugin URI: indyhall/central-hall for afragen/github-updater, but there is no newer tag or Update URI, so WordPress will not deliver a fix. Settings::registerSettings is still a FIXME with no GUI, AngularJS 1.x is bundled in portal/build, and the default-guest-password plus JSONP-GET-password issues above have no in-tree remediation. An authentication/network-gate plugin that has been unmodified for more than a decade is not safe to run.

  central-hall.php:1-13

  Recommendation

  Do not deploy this plugin on production WordPress. Replace the captive-portal integration with a maintained SSO/RADIUS/captive-portal stack, rotate the guest password if this was ever used, and remove the plugin so the public JSONP login/guest actions disappear.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.