High-severity findings.

Audited release

1.30.5

Findings

6

Worst severity

high

Content hash

2d8e5dc3740f2d4921161dfc… Copy

Findings

• high Contributor+ SSRF and web-accessible file write via [mygame] poster attribute

  ssrf

  add_shortcode('mygame') is registered unconditionally. apip_game_detail() returns early only if apip_settings[gaintbomb_key] is empty. When id is the literal 'x', Giantbomb is skipped: thumb_url is taken from the poster shortcode attribute, file_get_contents() fetches that URL (allow_url_fopen, optional WP_HTTP_Proxy, SSL verify disabled in the stream context), and the raw body is file_put_contents()'d to ABSPATH/wp-content/gallery/game_poster/nodata_{post_id}.jpg, which is then served from APIP_GALLERY_URL. There is no host allow-list, no private-IP block, and no content-type check before the write. An Author can publish, or a Contributor can preview, [mygame id="x" poster="http://169.254.169.254/latest/meta-data/"] and then GET the resulting jpg to read the SSRF response. Requires the Giantbomb key option to be configured (the feature's normal setup).

  apip.php:2537-2629

  Recommendation

  Do not fetch URLs from shortcode attributes. If local posters are needed, accept only attachment IDs from the Media Library. If remote fetch stays, allow-list https hosts, block link-local/private/metadata ranges, use wp_remote_get with a short timeout, and write only after getimagesize() confirms a real image. Never store the raw response at a guessable public path.

• high Stored XSS in [mygame]/[mydouban]/[myimdb] shortcode attributes echoed unescaped

  xss_stored

  Authors (unfiltered_html = false) and Contributors cannot plant raw <script> in post_content, but they can insert these shortcodes. apip_game_detail interpolates cname, jname, alias, publisher, genres, platform, year, and especially download (href) into frontend HTML with no esc_html/esc_url. [mygame] is always registered. [mydouban]/[myimdb] register when apip_douban_enable is on: apip_dou_movie_detail echoes the id attribute on the movie_not_found branch; apip_imbd_detail echoes cname; apip_dou_book_list echoes the link attribute as href. A payload such as [mygame id="x" cname="<img src=x onerror=alert(1)>" download="javascript:alert(1)"] executes for every visitor once an Author publishes, and for editors previewing a Contributor draft. Theme cooperation is not required; the_content runs the shortcode.

  apip.php:2642-2724

  Recommendation

  Escape every shortcode attribute and API field at the echo site: esc_html() for text, esc_url() for href/src (and reject javascript:/data:). Treat Douban/OMDB JSON fields as untrusted as well. Consider restricting these shortcodes to unfiltered_html roles.

• medium Unauthenticated open redirect via unsigned /gaan/<base64> cloaker

  unsafe_input

  When apip_settings[redirect_external_link] is enabled, convert_to_internal_links rewrites off-site http(s) hrefs in content and comments to /gaan/<base64(url)>, and apip_template_redirect (hooked on template_redirect, including 404s — no rewrite rule needed) calls apip_e2i_redirect(). That function takes everything after home_url()/gaan/, base64_decodes it, and wp_redirect() 302s with no HMAC, expiry, or destination allow-list. Any visitor can open https://victim/gaan/aHR0cHM6Ly9ldmlsLmNvbQ== and leave the origin toward an arbitrary URL, which is phishing/credential-harvest material under the site's domain. wp_sanitize_redirect only strips control chars; it does not confine the target.

  apip.php:1046-1062

  Recommendation

  Sign cloaked URLs (HMAC of the destination + site_url secret) or store an allow-listed map of IDs→URLs. Reject destinations whose host is not in the original content, and block non-http(s) schemes. Do not redirect on attacker-supplied base64 alone.

• medium Yandex Translate API key localized to every wp-admin user including Subscriber

  information_disclosure

  apip_admin_scripts is hooked to admin_enqueue_scripts with no $hook or capability gate, so it runs on Subscriber-accessible screens (profile.php, dashboard). wp_localize_script('apip-js-admin','yandexkey',$apip_options['yandex_translate_key']) prints the raw Yandex Translate API key as a JS global. A logged-in Subscriber viewing page source recovers a billed third-party credential and can call translate.yandex.net until quota/exhaustion or key revocation. The key is only needed on the post-edit slug metabox.

  apip.php:608-615

  Recommendation

  Enqueue apip-js-admin and localize the key only on post.php/post-new.php and only for users who can edit_posts. Prefer a wp_ajax proxy that attaches the key server-side so it never appears in HTML. Rotate any key that was stored while this version ran.

• medium Core wp-comments-post.php and xmlrpc.php overwritten with die() after WordPress updates

  insecure_config

  upgrader_process_complete always calls apip_remove_default_risk_files, which copies ext/wp-go-die.php (literal <?php die();) over ABSPATH/wp-comments-post.php and xmlrpc.php after every core upgrade. This is not option-gated. register_uninstall_hook points at an empty apip_plugin_deactivation, so removing the plugin leaves comments and XML-RPC permanently dead. On a site that still uses the comment form, this is a persistent availability break and a surprise core-file modification that security scanners will flag as integrity failure. Attackers do not trigger it; WordPress auto-update does.

  apip.php:760-768

  Recommendation

  Do not overwrite WordPress core files. Disable XML-RPC via the xmlrpc_enabled filter (already present) and protect comments with capability/nonce/antispam. If the copies must stay, restore the originals from a backup on uninstall and make the behavior an explicit, default-off option.

• medium Activation mkdir/chmod uses string '511' which is decimal 0777 on web-accessible cache dirs

  insecure_config

  apip_plugin_activation creates wp-content/gallery/{gravatar_cache,douban_cache,game_poster} with mkdir($path, '511', true) and chmod($path, '511'). PHP casts the string '511' to integer 511 decimal, which is octal 0777 (world-writable), not mode 0511. Recursive mkdir also creates wp-content/gallery itself with that mode if missing. Those directories are served as APIP_GALLERY_URL. On shared hosting another tenant can drop a PHP webshell next to cached jpgs; on a dedicated box 0777 still lets any local user write. Combined with the [mygame] write path, the cache tree is both world-writable and world-readable.

  apip.php:31-67

  Recommendation

  Pass integer octal modes (0755 or 0750), never decimal strings. Deny PHP execution in those dirs (.htaccess php_flag engine off / nginx location). Do not chmod existing directories to world-writable.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.