Medium-severity findings.

Audited release

0.4.3

Findings

1

Worst severity

medium

Content hash

f7a851c193f5ddc876e63ce7… Copy

Findings

• medium Export output written to predictable public uploads directory without protection

  information_disclosure

  get_export_dir() returns WP_CONTENT_DIR/uploads/wp2grav-exports/user-<Ymd>/. The users exporter writes accounts/<username>.yaml for every WordPress user, containing email, roles, display and first/last names, and a plaintext generated password intended for the Grav site. The posts exporter includes drafts, scheduled and private posts. No .htaccess, index file or random component protects the directory, so anyone can download the files by guessing the date and usernames, or by browsing if directory indexes are enabled. The exports persist until an admin deletes them.

  wp2grav-exporter.php:274-276

  Recommendation

  Write exports outside the web root or into a directory with a random secret component plus deny-all .htaccess and index.php. Better, stream a ZIP download to the admin and delete the files afterwards.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.