ItihRag AI Chatbot WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.1.1

Findings

1

Worst severity

low

Content hash

e1329b0d0ad67f29ccafd29d… Copy

Findings

• low Per-session ownership secret disclosed to any caller presenting a known session_id

  information_disclosure

  The public (permission_callback returns true) POST /itih/v1/chat and /chat/sync routes call resolve_session($request->get_param('session_id')). When the supplied session_id exists, resolve_session() re-reads the stored secret from the chat_sessions table and the handler returns it to the caller as session_secret (SSE 'meta' event / JSON). The secret is what verify_session() requires (X-Itih-Secret) before GET/DELETE /history and POST /feedback return or modify a session's turns. Anyone who learns a session id (e.g. from the admin CSV export, logs, shared screenshots, or a browser localStorage leak) can therefore obtain the secret, read the full conversation history (which may contain PII visitors typed), delete it, alter feedback, and append turns into the victim's session. Session hashes are 256-bit random and are not otherwise exposed publicly, so practical exploitability is limited; rated low.

  includes/Chat/class-chat-controller.php:206, 246, 273, 307, 664-676

  Recommendation

  Only return session_secret when a new session is created. For an existing session_id, require the caller to present the matching X-Itih-Secret (verify_session) before appending turns, otherwise start a fresh session.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.