Órbita WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+ #10 in Social & Sharing

High-severity findings.

Audited release

2.0.1

Findings

4

Worst severity

high

Content hash

fc747d330b888131e066eff5… Copy

Findings

• high Authenticated reflected XSS in [orbita-form] via t and u query parameters

  xss_reflected

  orbita_form_shortcode() copies $_GET['t'] and $_GET['u'] through sanitize_text_field() (strips tags, does not encode quotes) and concatenates them into HTML attributes without esc_attr(). The form is shown only after is_user_logged_in(), so any Subscriber (the plugin adds publish_orbitas to that role and links wp_registration_url()) or higher who opens a crafted URL such as /orbita/postar/?t=%22%20onfocus%3Dalert%28document.domain%29%20autofocus%3D%22x or the same in u= executes attacker JavaScript in the site origin. The bookmarklet documented in the shortcode is designed to pass document.title/location through these params. SameSite=Lax still sends auth cookies on this GET navigation, so an administrator who uses the board can be hit by a mailed/posted link (session takeover: plugin install, user create). Unauthenticated visitors hit the login prompt and never reach the sink.

  orbita.php:804-825

  Recommendation

  Escape both values with esc_attr() (and put the title into the textarea body, not a value attribute). Prefer sanitize_url() for u. Keep the logged-in gate.

• high CSRF publishes orbita_post as any logged-in user (nonce checked only on the display shortcode)

  csrf

  add_action('wp_loaded','orbita_form_post') treats any POST with orbita_post_title as a submit. The handler never calls wp_verify_nonce or current_user_can. The orbita_nonce field is created in orbita_form_shortcode() and verified there only when rendering the form, which does not run before this writer (and a successful submit wp_redirect()s away). After is_user_logged_in(), it wp_insert_post()s a published orbita_post with unsanitized title/content (kses applies only for users without unfiltered_html), stores external_url, optionally fetches og:image via wp_safe_remote_request, and auto-upvotes. A cross-site form can therefore publish spam/malware links as a Subscriber, or, if the victim is an administrator, store raw HTML/JS. orbita_get_post_html() then echoes get_the_title() into a title="..." attribute and link text without esc_attr/esc_html, so that admin CSRF becomes stored XSS on [orbita-posts]/[orbita-ranking] for every visitor. File inputs cannot be filled cross-origin, so the upload branch is not a practical CSRF vector; URL/title/content are.

  orbita.php:882-1021

  Recommendation

  Move processing into the same request as the form, require wp_verify_nonce($_POST['orbita_nonce'], 'orbita_nonce') and current_user_can('publish_orbitas') before wp_insert_post, and reject missing nonces. Escape titles on output with esc_attr/esc_html in orbita_get_post_html() and single-orbita.php.

• medium REST likes route has no permission_callback and writes vote meta on arbitrary posts

  missing_permission_callback

  register_rest_route('orbitaApi/v1','/likes/') registers POST with callback orbita_update_post_likes and no permission_callback, so WordPress does not run a REST permission check (public at the routing layer; _doing_it_wrong since 5.5). The callback returns if get_current_user_id() is 0, so unauthenticated and cookie-auth-without-nonce requests do nothing. Any logged-in user who can present a wp_rest nonce (localized as orbitaApi.restNonce on every orbita shortcode/singular page) can POST post_id for any post type. orbita_increase_post_like() does not verify orbita_post; it appends the user id to post_users_vote and increments post_like_count on that post. Observable: a Subscriber can stamp those keys onto pages, attachments, or WooCommerce products; ranking reads post_like_count as score and public/main.js assigns jsonData.count via innerHTML (integer increment, not HTML XSS).

  orbita.php:1227-1273

  Recommendation

  Set permission_callback to a function that requires is_user_logged_in() (REST cookie nonce still applies). Accept post_id from WP_REST_Request, absint it, and refuse IDs that are not a published orbita_post. Keep one-user-one-vote.

• medium Unauthenticated GET of a discussion post overwrites orbita_category

  missing_auth

  single-orbita.php is loaded via the single_template filter for orbita_post. On every view, if external_url meta is empty it looks up the term named 'conversas' and calls wp_set_object_terms( $post_id, $term_id, 'orbita_category' ) with default append=false, replacing all terms. There is no capability check, nonce, or request-method guard. Any visitor (including unauthenticated) who opens such a permalink mutates taxonomy. Impact is limited to the conversas classification used by this board and is a no-op if that term has not been created, but on the intended Manual do Usuário-style install it is a persistent unauthenticated write.

  single-orbita.php:31-38

  Recommendation

  Assign the conversas term at publish time in orbita_form_post (or a save_post hook) with current_user_can, not in the public template. If a template-side fix is needed, set terms only when empty and only for users who can edit the post.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.