High-severity findings.

Audited release

1.3.0

Findings

3

Worst severity

high

Content hash

2788d06ba4c9b24264db153e… Copy

Findings

• high Unauthenticated cron/exec.php loads WordPress and runs the full monitoring job with no secret

  missing_auth

  cron/exec.php is web-reachable under wp-content/plugins/ (no .htaccess, no index.php, no php_sapi_name()==='cli' check, no shared secret). It requires cron/bootstrap.php, which sets ignore_user_abort(true), memory_limit 512M, max_execution_time 0, define('DOING_CRON', true), and include_once of wp-load.php (or eval's an ABSPATH line from wp-config.php as a fallback). It then calls Functions::exec_crontab_task() with no authentication. That method SELECTs every name,url from {$wpdb->prefix}mainwp_wp, curl_init's each URL with CURLOPT_FOLLOWLOCATION, optionally runs exec('top -bn 1 | awk …'), exec('free | awk …'), and shell_exec('/usr/sbin/service nginx|mysql status') when option mainwp_monitoring_notify_show_system_info is truthy, then POSTs the assembled message to https://notify-api.line.me/api/notify using the stored LINE token, sleeping 3s per chunk, with no concurrency lock. Observable as an unauthenticated visitor: GET /wp-content/plugins/mainwp-monitoring-notify/cron/exec.php starts a long-lived PHP worker that will continue after the client disconnects, floods the operator's LINE chat, and issues outbound HTTP to every managed child site. Parallel requests fork-bomb the dashboard (the box that holds every child-site credential). This is not RCE (the exec strings are hardcoded) and the HTTP response only echoes 'All sites are online' or a class-missing notice — blast is availability plus notification/SSRF-to-inventory abuse.

  cron/exec.php:1-6

  Recommendation

  Refuse non-CLI invocation (php_sapi_name() !== 'cli' and empty $_SERVER['argv']) or require a high-entropy secret in the query string compared to an option that is never printed. Deny HTTP access to cron/ with .htaccess/nginx. Drop ignore_user_abort/unlimited time for web SAPIs. Add a file lock so overlapping runs exit. Do not eval wp-config.php.

• high Settings AJAX has no capability check (and is registered nopriv); Subscriber+ can read and overwrite the LINE Notify token

  missing_capability

  Bootstrap registers both wp_ajax_mainwp_monitoring_notify_update and wp_ajax_nopriv_mainwp_monitoring_notify_update to update_callback(). The handler only check_ajax_referer('mainwp-monitoring-notify-extension') then sanitize_text_field's POST and update_option's mainwp_monitoring_notify_line_token, _interval_in_minute, _only_notify_when_site_offline, _hide_healthy_sites, and _show_system_info. There is no current_user_can('manage_options') (or mainwp_current_user_can) in the handler. MainWP core adds this extension page with capability 'read' and slug Extensions-Mainwp-Monitoring-Notify; a logged-in Subscriber can load that URL. admin_init matches stripos($_GET['page'], 'Mainwp-Monitoring-Notify') and wp_localize_script's a usable per-user nonce; render_fields() prints the current token in <input value="<?=$line_token?>"> with no esc_attr. Observable: Subscriber views the live LINE bearer token, then POSTs admin-ajax.php?action=mainwp_monitoring_notify_update with that nonce and their own token (and show_system_info=1). Subsequent exec_crontab_task()/handle_offline_site() deliveries go to the attacker's LINE chat with every child-site name/URL/HTTP code and dashboard CPU/RAM/load/nginx/mysql status. sanitize_text_field does not encode quotes, so a token such as " autofocus onfocus="alert(document.domain) stored here is admin stored XSS when an administrator later opens Settings. wp_ajax_nopriv_ is extra attack surface; unauth still needs a uid-0 nonce that this plugin only mints on the admin page, so the practical write is authenticated-low-priv, not anonymous.

  mainwp-monitoring-notify.php:45-47,94-145,203-214

  Recommendation

  Remove the nopriv hook. In update_callback, require current_user_can('manage_options') (or a MainWP right checked after plugins_loaded) in addition to the nonce. Do not print the LINE token into the form; use type=password / a 'token is set' placeholder. Escape with esc_attr() if it must be shown. Move the mainwp_current_user_can gate out of plugin-include time so it actually runs after have_right exists.

• medium admin_post_run_test has no nonce or capability check, so any logged-in user or CSRF GET triggers the monitoring job

  csrf

  Bootstrap hooks admin_post_run_test to static run_test_callback(), which immediately calls Functions::exec_crontab_task() with no wp_verify_nonce, no check_admin_referer, and no current_user_can. WordPress admin-post.php fires admin_post_{action} for every is_user_logged_in() user. The settings-page jQuery posts {action:'run_test'} to admin-post.php with no nonce field. Observable: a Subscriber GET or POST /wp-admin/admin-post.php?action=run_test runs the same curl/LINE/optional-exec job as finding 1. Cross-site CSRF of an administrator also works via a top-level GET navigation (WordPress auth cookies are SameSite=Lax, which are sent on top-level GET). Blast is the same monitoring-job side effects (LINE flood, child-site traffic, optional host command execution) without changing stored settings — limited compared with token theft, hence medium.

  mainwp-monitoring-notify.php:47,162-165

  Recommendation

  Rename the action to a plugin-prefixed slug. Require check_admin_referer plus current_user_can('manage_options') before exec_crontab_task(). Send the nonce from localized script and reject GET. Do not use a generic action name like run_test.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.