RSS News Carousel WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.8

Findings

2

Worst severity

high

Content hash

05d88f1ed8b21004d57c885e… Copy

Findings

• high Unauthenticated SSRF via REST feed_url parameter

  ssrf

  register_rest_route feed uses permission_callback __return_true. Callback passes attacker-controlled feed_url into SimplePie, causing the server to fetch arbitrary URLs (internal services, cloud metadata) and return parsed content.

  rss-news-carousel.php:326-355

  Recommendation

  Remove public arbitrary URL fetching; only allow preconfigured feed URLs from options, or require manage_options and block private IP ranges.

• low Unauthenticated AJAX log endpoint

  dos

  wp_ajax_nopriv_rss_news_carousel_log accepts message POST and writes to the plugin error log without auth/nonce — log spam / disk DoS.

  rss-news-carousel.php:360-375

  Recommendation

  Remove nopriv logging or require a nonce and rate limit.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.