Reading Time & Progress Pro WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

medium

Content hash

3250cec0b21766cdc6bea481… Copy

Findings

• medium Remote premium payload executed via eval()

  eval_by_design

  After license validation, rpp_load_premium_code() decrypts files fetched from the vendor API (stored in option rpp_premium_files) and eval()s them. Compromise of the license API, MITM, or option tampering yields RCE. This is eval-by-design for licensing, not a classic unauth RCE, but it is elevated supply-chain risk on every licensed site.

  inc/license.php:320-348

  Recommendation

  Replace eval with shipped PHP files or OPCache-friendly includes verified by signature; never execute API-returned code blobs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.