Find WordPress HTTP Links WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.2

Findings

2

Worst severity

high

Content hash

e5c2ee1e8fe92c37c46eb22e… Copy

Findings

• high Content-replace AJAX lacks capability and per-post authorization

  missing_capability

  Tools submenu is gated by edit_published_posts (Author+), but AJAX handlers fwhl_replace_text, fwhl_replace_published_content, fwhl_replace_custom, and meta replace variants only call check_ajax_referer — no current_user_can('edit_post', $id) or manage_options. An Author who can open Tools → Find HTTP Links receives nonces in admin_footer and can rewrite post_content/postmeta for arbitrary post IDs, including others' content and bulk published replacements.

  find-wp-http-links.php:844-857

  Recommendation

  Require manage_options (or edit_others_posts) for bulk replace, and for single-ID replace require current_user_can('edit_post', $id). Prefer $wpdb->prepare / wp_update_post over string-interpolated SQL.

• medium SQL built by interpolating request-derived URL strings

  unsafe_input

  Replace handlers embed esc_url_raw($_POST['from']/['to']) directly into SQL UPDATE/SELECT strings. esc_url_raw is not a SQL escape. On modern WP, magic quotes reduce classic quote-break SQLi, but this remains unsafe input handling and can break queries or enable edge-case injection if escaping assumptions change. Classify as unsafe_input (not critical SQLi) per wp_magic_quotes guidance.

  find-wp-http-links.php:849-852

  Recommendation

  Use $wpdb->prepare with placeholders, or load content via get_post/wp_update_post and perform replace in PHP.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.