WP Tracker Pro WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.0

Findings

1

Worst severity

medium

Content hash

038ec049cd8f6fb406f5fdc4… Copy

Findings

• medium Remote premium PHP executed via eval()

  eval_by_design

  itp_download_premium stores encrypted PHP blobs from https://dp-starter.khalid.digital into option itp_premium_files. itp_load_premium_code decrypts with a key derived from the license key and eval()s the string. This is intentional license gating but is eval-by-design: any compromise of the remote API, MITM (if TLS broken), or write to that option becomes RCE.

  inc/license.php:307-361

  Recommendation

  Ship premium code in signed plugin packages or verify Ed25519 signatures over plaintext before include; avoid eval of option-stored PHP.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.