ParsaSpace CDN Host WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

2.3.0

Findings

3

Worst severity

high

Content hash

f1c53f5e01e0e44a99c4cd7c… Copy

Findings

• high Subscriber+ can run all ParsaSpace AJAX actions: CDN settings, sitewide URL replace, and remote file delete

  missing_capability

  Wp_Parsaspace_Admin_Ajax registers ten wp_ajax_* actions from a method whitelist. Every handler's only gate is check_ajax_referer('wp_parsaspace_token','security'); none call current_user_can. The matching nonce is localized as wp_parsaspace_ajax.security inside enqueue_scripts on every wp-admin page (chart.js is limited to toplevel_page_parsaspace_setting; the nonce is not). A Subscriber visiting /wp-admin/profile.php therefore receives a usable nonce and can GET admin-ajax.php as themselves. Observable without a ParsaSpace account: change_parsaspace_setting_form writes is_optimize/quality_jpg/max_size_upload/remote_dir into autoloaded wp_parsaspace_opt (upload_size_limit then does remove_all_filters('upload_size_limit') and returns 1024*1024*max_size_upload for the whole site); reset_all_url_in_db_parsaspace DELETEs all cdn_parsaspace postmeta and REPLACE()s the current CDN base URL with wp_upload_dir()['baseurl'] across posts.post_content and postmeta.meta_value. If the site is already connected, the same caller uses the stored Bearer token as a confused deputy: change_setting_domain_parsaspace / install_parsaspace overwrite api_token/domain_name/is_ssl/base_folder (front-end get_attachment_url then prefixes every attachment with that host), wp_remove_path_parsaspace deletes an arbitrary CDN path, wp_parsaspace_filemanager_api lists the bucket, and transfer_to_parsaspace rewrites a chosen attachment's URL. The settings UI is manage_options-only; that cap is never checked on the AJAX path.

  includes/class-wp-parsaspace-admin-ajax.php:11-26,36-127,136-210,347-437,446-479,797-835

  Recommendation

  Require current_user_can('manage_options') (or a dedicated cap) in every AJAX handler before any option/DB/API work, in addition to the nonce. Only localize wp_parsaspace_ajax on toplevel_page_parsaspace_setting for users who pass that cap. Do not interpolate URLs into SQL; use $wpdb->prepare or a safe replace helper.

• high Subscriber+ SSRF: remote-upload AJAX makes the site HEAD any URL, then asks ParsaSpace to fetch it

  ssrf

  request_remote_url_to_parsaspace is one of the nonce-only wp_ajax actions. After empty-checks it assigns $file_url = trim($_GET['file_url']) with no wp_http_validate_url, scheme allowlist, or host blocklist. Helper::curl_get_file_size() curl_init's that URL with CURLOPT_NOBODY and CURLOPT_FOLLOWLOCATION (max 3 redirects) from the WordPress server — so a Subscriber can probe http://127.0.0.1, http://169.254.169.254/, http://[::1]/, and other internal endpoints via status/size. If the HEAD reports a non-zero Content-Length, Api::CreateFolder + Api::RemoteUpload POST the same attacker URL to http://api.parsaspace.com/v1/remote/new using the site's stored Bearer token, causing the CDN to retrieve it. file_name is optional; when omitted the remote basename is kept. Observable as Subscriber with the localized nonce: GET admin-ajax.php?action=request_remote_url_to_parsaspace&security=<nonce>&file_url=http://<internal>&file_name=.

  includes/class-wp-parsaspace-admin-ajax.php:489-583

  Recommendation

  Gate the handler with manage_options. Validate file_url with wp_http_validate_url (HTTPS only) and reject loopback, link-local, private, and non-http(s) schemes. Do not follow redirects to those destinations. Prefer wp_safe_remote_head over raw curl.

• high Subscriber can store admin XSS in remote_dir; file manager HTML is inserted via jQuery.html

  xss_stored

  change_parsaspace_setting_form (nonce-only, no TestApi) sets wp_parsaspace_opt['remote_dir'] to remove_slash(trim($_GET['remote_dir'])), which strips / and \ but leaves quotes, angle brackets, and event handlers. meta_box_system echoes that value into an unescaped input: value="'.$opt['remote_dir'].'". The settings page is manage_options, so when an administrator opens ParsaSpace → settings the payload runs in the admin session (e.g. " autofocus onfocus="…. request_remote_url_to_parsaspace then CreateFolder('/'+remote_dir), so a folder with the same name appears in the file manager. wp_parsaspace_filemanager_api concatenates unsanitized $_GET['path'] and $l['Name'] into HTML attributes and cell text; admin/js/wp-parsaspace-admin.js assigns the JSON text field with $(".parsaspace_content_file_manager").html(data['text']), which executes inline event handlers (and historically script nodes). That is a reliable admin-session XSS after the Subscriber write, i.e. site takeover once an admin visits the plugin screen or opens the file manager.

  admin/class-wp-parsaspace-admin-ui.php:318-322

  Recommendation

  Sanitize remote_dir to a safe folder slug (alphanumeric/dash) on write. Escape option values with esc_attr/esc_html on output. Escape file-manager names/paths before building HTML, or switch the JS consumer to .text() / DOM APIs. Still require manage_options on the write AJAX.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.