Waterfall Reviews WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB-

Medium-severity findings.

Audited release

0.3.0

Findings

3

Worst severity

medium

Content hash

08f700c9c109609c3f9415e1… Copy

Findings

• medium Unauthenticated chart AJAX discloses arbitrary review post meta

  information_disclosure

  wp_ajax_nopriv_get_chart_data builds Charts with meta from sanitize_key($_POST['key']) and returns chart datasets. Charts::get_chart_data() does not enforce the UI selector whitelist ($this->meta); it queries all published reviews (posts_per_page -1) ordered by that meta_key and calls get_post_meta($review, $metakey) for each. An unauthenticated caller can supply any meta key (including underscore-prefixed keys that sanitize_key preserves) and receive values for published reviews in the JSON response. Observable consequence: bulk disclosure of review custom fields not meant for public charting.

  classes/class-ajax.php:32-62

  Recommendation

  Whitelist allowed meta keys against configured properties/criteria before querying. Reject unknown keys. Cap posts_per_page. Fix nonce verification (wp_verify_nonce($_POST['nonce'], 'we-love-good-reviews')) and abort on failure if CSRF matters for your deployment.

• medium Unauthenticated review filter AJAX forces unbounded post queries

  dos

  filter_reviews (also registered as wp_ajax_nopriv_filter_reviews) builds a WP_Query/get_posts args array from attacker-controlled filters, then calls get_posts(wp_parse_args(['posts_per_page' => -1], $args)) before rendering. Any visitor can trigger a full-table scan of the reviews CPT repeatedly. Charts AJAX similarly uses posts_per_page => -1. Observable consequence: CPU/DB DoS on sites with large review catalogs.

  classes/class-ajax.php:126-317

  Recommendation

  Remove the posts_per_page=-1 override or hard-cap results. Add rate limiting for nopriv ajax. Ensure the primary query uses a sane page size only.

• low AJAX nonce check is inverted and ignored

  missing_nonce

  All three ajax handlers call wp_verify_nonce("we-love-good-reviews", $_POST["action"]) — arguments are swapped versus wp_verify_nonce($nonce, $action), and the boolean return value is discarded. The call never validates a client nonce. Impact is limited because the endpoints are intentionally public and read-only, but it provides a false sense of CSRF protection.

  classes/class-ajax.php:34-34

  Recommendation

  Use check_ajax_referer('we-love-good-reviews', 'nonce') with a real nonce field, or remove the dead call if endpoints stay public.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.