Medium-severity findings.

Audited release

1.0.3

Findings

1

Worst severity

medium

Content hash

99d37fdcdc6490f79dc4ccd4… Copy

Findings

• medium Subscriber can rewrite any image crop and regenerate the media library via nonce-only AJAX

  missing_capability

  All plugin AJAX actions are registered as wp_ajax_* only (logged-in) and share BaseAjaxCall::validate_nonce(), which calls check_ajax_referer('image-crop-positioner') and then returns. No handler calls current_user_can('edit_post', $attachment_id) or manage_options. Assets::enqueue_admin runs on admin_enqueue_scripts with no screen or capability guard, so wp_create_nonce('image-crop-positioner') is printed as image_crop_positioner_options.nonce on every admin page, including the dashboard and profile.php that a Subscriber can load. After scraping that nonce the same user can POST admin-ajax.php: (1) action=image_crop_positioner_save_faces / save_hotspots / remove_faces with any image attachment_id — AttachmentMeta writes image_crop_positioner_faces or _hotspots and Regenerate::execute immediately runs wp_generate_attachment_metadata, which Crop::crop uses to overwrite every intermediate size; those files are what the front end displays. (2) action=image_crop_positioner_migrate with migrator=regenerate_images (or the My Eyes Are Up Here importers) and an attacker-chosen per_page, paging through every image in the library. Face detection, image-preview HTML, and encode_image (original bytes as data: base64, with a wp_remote_get fallback to wp_get_attachment_image_src) are likewise ungated beyond the nonce. Nonce is not authorization: it is uid-scoped and this plugin hands every logged-in role a valid one.

  app/Ajax/BaseAjaxCall.php:12-21

  Recommendation

  Add current_user_can('edit_post', $attachment_id) (fail closed) in BaseAjaxCall before any attachment-scoped work. Require current_user_can('manage_options') on image_crop_positioner_migrate. Restrict admin_enqueue_scripts to the attachment/media and plugin settings screens so Subscriber profile.php does not receive a usable nonce. Cap migrator per_page and do not treat a passing nonce as a capability check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.