WHMCS WordPress WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

2.1.1

Findings

2

Worst severity

medium

Content hash

8144b73effcd5255854566c0… Copy

Findings

• medium Unauthenticated WHMCS customer/user enumeration via privileged API proxy

  information_disclosure

  POST /wp-json/whmcs-wordpress/v1/email/is-registered has no permission_callback and no nonce. is_email_registered() runs GetClients and GetUsers with search=<sanitized email> using the site's WHMCS API identifier/secret. Both APIs prefix-match email/name (GetClients also companyname). The route returns {isRegistered: true|false} to any caller. The public form uses this to decide whether to show the password step, so it is intentional UX, but it is still an unauthenticated oracle over WHMCS clients and users and is broader than exact-email lookup. An attacker can confirm which billing emails exist (and probe prefix collisions used in the SSO finding) without a WHMCS account.

  includes/class-whmcs-wordpress-api.php:63-68,112-122

  Recommendation

  If the check must stay public, use an exact-email API (GetClientsDetails email=) and rate-limit by IP. Return the same response for invalid and unregistered addresses. Set an explicit permission_callback. Do not expose GetUsers/GetClients prefix search to the internet.

• medium Unauthenticated WHMCS password-reset proxy with no server-side rate limit

  dos

  POST /wp-json/whmcs-wordpress/v1/password/reset has no permission_callback, nonce, capability, or CAPTCHA. reset_password() forwards the sanitized email to WHMCS ResetPassword using admin API credentials and returns {success: <bool>}. success is false when WHMCS reports User Not Found, so this endpoint also enumerates users. The Quasar form stores lastPasswdResetTime in LocalStorage for 300000ms; that throttle is per-browser and is not enforced in PHP. Any visitor can therefore trigger WHMCS password-reset mail for every enumerated customer, skipping whatever captcha the native WHMCS reset form might use. Observable consequence: mailbox flooding of WHMCS users and a second user-existence oracle.

  includes/class-whmcs-wordpress-api.php:70-75,124-130

  Recommendation

  Rate-limit ResetPassword in PHP (IP + email), do not return a boolean that distinguishes User Not Found, and add CAPTCHA. Set permission_callback explicitly. Prefer sending users to the WHMCS reset form instead of proxying the admin API.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.