Klyp Contact Form 7 to ZOHO WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.0.4

Findings

2

Worst severity

medium

Content hash

638a58dba0c7e52681466411… Copy

Findings

• medium Zoho OAuth token AJAX missing capability check

  missing_capability

  klypCF7ToZohoGetTokenAccess is registered on wp_ajax_ and verifies nonce klypCF7ToZoho only — no current_user_can('manage_options'). The settings page that emits the nonce requires manage_options, so practical abuse is primarily CSRF/defense-in-depth if a nonce leaks, but the handler should still enforce manage_options before performing OAuth token exchange with attacker-supplied client_id/secret/code.

  inc/settings.php:86-119

  Recommendation

  Add current_user_can('manage_options') (and check_ajax_referer) before any Zoho request; do not echo raw remote bodies without validation.

• medium data_centre parameter concatenates into outbound Zoho URL (SSRF-style host control)

  ssrf

  User-controlled data_centre is concatenated as https://accounts.zoho.{data_centre}/oauth/v2/token. A value like com.attacker.example yields https://accounts.zoho.com.attacker.example/... allowing the server to POST OAuth client secrets to an attacker-controlled host when the AJAX handler runs in an admin session.

  inc/settings.php:100-116

  Recommendation

  Allowlist data centres (e.g. com, eu, in, com.au) and reject all other values. Never concatenate unsanitized host suffixes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.