Smart Redirect Pro WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- #7 in SEO & Metadata

High-severity findings.

Audited release

2.0.0

Findings

1

Worst severity

high

Content hash

7914bf5f3760612b35bdbd73… Copy

Findings

• high Remote Worker PHP stored in srp_premium_files is eval()'d on every licensed request

  eval_by_design

  After a successful license, srp_download_premium() POSTs the license key to https://dp-starter.khalid.digital/premium and writes the JSON files object to option srp_premium_files. srp_load_premium_code() runs from the main plugin file on every request (front-end included) whenever srp_is_licensed() is true: it re-downloads when transient srp_premium_fresh is missing (daily), AES-256-GCM-decrypts the named 'click-log' blob with a key derived from the license key (str_pad(substr(strtoupper(str_replace('-','',$key)),0,32),32,'0')), and eval()s the plaintext. There is no public-key signature, hash allow-list, or on-disk reviewed file — AES-GCM only proves the Worker that knows the license key produced the ciphertext, and that Worker can change the PHP at the next refresh without a plugin update. Unlike a full stub, CPT/redirect/tracker PHP ships in the zip, but click-log (and anything else the Worker puts under that name) still executes as the web user on every licensed hit, so a compromised or malicious Worker is site RCE. A second path from the same host: srp_check_plugin_update() GETs /update-check?product=smart-redirect-pro with no license check and copies data.download_url into the update_plugins transient package field (no zip hash). srp_force_update_check on admin_init (no capability) can delete that transient once per hour, including from unauthenticated admin-ajax.php, accelerating the next fetch. This is vendor DRM rather than a hidden webshell, but it is persistent DB-stored PHP execution scanners will not see in wp-content/plugins.

  inc/license.php:307-363

  Recommendation

  Ship the click-log PHP in the plugin zip (or extract a signed package onto disk and include those files). Do not eval() option-stored blobs. If remote delivery stays, verify an Ed25519/public-key signature over the plaintext, pin the Worker identity, and fail closed on mismatch. Stop injecting an unsigned download_url into update_plugins; at least require a sha256 of the zip. Gate srp_force_update_check behind manage_options (or remove it).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.