MFN Feed WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

0.0.93

Findings

4

Worst severity

high

Content hash

e7484d6ff807ec5ada124ad6… Copy

Findings

• high CSRF on cc.php deletes posts/tags and clears settings with no nonce

  csrf

  cc.php is a wp-load.php command center invoked by GET from admin JS (plugin_url+'/cc.php?mode=...'). The only gate is current_user_can('manage_options'); the plugin contains zero wp_verify_nonce/check_admin_referer calls. Modes delete-all-posts, delete-all-tags, clear-settings, unsubscribe, subscribe, and sync are state-changing. An attacker page can CSRF a logged-in administrator (or an XSS payload on the frontend can fetch() in a loop). Observable effect: wp_delete_post on every mfn_news item, wp_delete_term on the MFN taxonomy, or update_option('mfn-wp-plugin', array()).

  cc.php:7-12,302-349

  Recommendation

  Replace the GET command center with admin-post/AJAX handlers that verify a capability and a nonce (check_admin_referer). Reject GET for destructive modes. Do not bootstrap wp-load.php for cookie-authenticated actions.

• high SQL injection in news-feed filtertags widget/shortcode attribute

  sql_injection

  When showfilter is on and filtertags is non-empty, the widget builds SELECT name FROM {prefix}terms WHERE slug = '{slug}' with string concatenation. $slug comes from the widget instance or from [mfn_news_feed_widget showfilter="1" filtertags="..."] (the_widget($atts)). sanitize_text_field() does not encode quotes. An Author (or Contributor whose post is published) can place a shortcode such as filtertags="x' UNION SELECT user_pass FROM wp_users--" and the result is printed into an <option> on the public page. Source is stored post_content/widget settings, so wp_magic_quotes does not apply at render time.

  widgets.php:1102-1154

  Recommendation

  Use $wpdb->prepare() with a %s placeholder (or get_term_by('slug', ...)). Escape $s and $name with esc_attr/esc_html when printing options.

• high WebSub posthook publishes or trashes news with optional/bypassable HMAC

  auth_bypass

  posthook.php is an unauthenticated wp-load.php endpoint. After a subscription exists, the only required secret is wp-name (posthook_name, a 32-character rand() token placed in the callback URL). HMAC is applied only when mfn-wp-plugin[verify_signature]==='on'; the runtime default is 'off'. When verification is on, the algorithm is taken from X-Hub-Signature and compared with !=. On PHP 7, hash_hmac() of an unknown algorithm returns false, and '' != false is false, so X-Hub-Signature: notahash= accepts any body. The handler then json_decodes php://input and calls mfn_upsert_item_full() (public mfn_news posts, attachments, optional media_sideload_image) or mfn_unpublish_item() (trash). GET hub_mode=subscribe writes attacker-controlled hub_challenge into mfn-subscriptions as subscription_id and echoes it unescaped.

  posthook.php:36-76,105-156

  Recommendation

  Always require HMAC (ignore the checkbox), allowlist sha256, and compare with hash_equals(). Generate posthook_name/secret with random_bytes/wp_generate_password. Do not treat GET hub_challenge as HTML; do not let GET overwrite subscription state without proving the request came from the hub.

• medium subscription_id localized on every wp-admin page for any logged-in user

  information_disclosure

  Mfn_Wp_Plugin_Admin::enqueue_scripts runs on admin_enqueue_scripts with no page or capability check, so a Subscriber visiting profile.php receives mfn_admin_params.subscription_id (the WebSub challenge UUID). The plugin itself unsubscribes with an unauthenticated GET to {hub}/verify/{subscription_id}?hub.mode=unsubscribe. A Subscriber who copies the ID can therefore drop the site's MFN subscription without manage_options.

  admin/class-mfn-wp-plugin-admin.php:85-112

  Recommendation

  Enqueue and localize only on the plugin settings page and only for manage_options. Treat subscription_id as a capability token; do not put it in any script visible to low-privilege users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.