Mehrana App Plugin WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

3.9.14

Findings

3

Worst severity

high

Content hash

e951320e38965c9c08ac1df5… Copy

Findings

• high Arbitrary file copy and deletion via backup_path/backup_filename in media restore/delete-backup REST routes

  file_access

  restore_media() takes a raw backup_path (or backup_filename appended to uploads/mehrana-backups/ with no traversal check), copies it next to the attachment file, and then unlink()s backup_path. delete_backup() concatenates backup_filename into the backups dir and unlink()s it. No realpath containment is done. Any user with edit_pages (Editor) or the API key can delete wp-config.php (forcing re-install / site takeover) or any other writable file, and copy non-PHP server files into the public uploads directory to read them.

  mehrana-app.php:1397-1518

  Recommendation

  Drop the backup_path parameter; accept only a basename (sanitize_file_name / basename), build the path under uploads/mehrana-backups and verify realpath() stays inside that directory before copy/unlink. Consider requiring upload_files + manage_options for file-level operations.

• medium Activity log written to publicly accessible wp-content/mehrana-app.log

  information_disclosure

  log() appends to WP_CONTENT_DIR . '/mehrana-app.log' (enabled by default: map_enable_logging defaults to '1'). Each entry contains the acting user's user_login, plus URLs, alt text, page IDs and S3 diagnostics. The file sits in the web root with no access protection, so unauthenticated visitors can download it and harvest admin/editor usernames.

  mehrana-app.php:2952-2962

  Recommendation

  Default logging off, write logs to a non-web-accessible or randomly named protected directory (with deny-all .htaccess / index.php), and avoid logging usernames.

• low API key generated client-side with Math.random()

  predictable_token

  The admin 'Generate Key' button builds map_api_key with two Math.random().toString(36) chunks in the browser. Math.random is not a CSPRNG; the key grants full mehrana/v1 access (including the file operations above) without any user context.

  mehrana-app.php:3206-3215

  Recommendation

  Generate the key server-side with wp_generate_password(40, false) or bin2hex(random_bytes(24)).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.