Medium-severity findings.

Audited release

2.0.7

Findings

1

Worst severity

medium

Content hash

4b1402887eb35216b30965e4… Copy

Findings

• medium Unauthenticated AJAX cache flush (no capability, no nonce)

  missing_auth

  QPlayer2 registers the same QPlayer2::ajax callback on both wp_ajax_QPlayer2 and wp_ajax_nopriv_QPlayer2. QPlayer2_Ajax treats request param do=flush as a privileged operation: it instantiates the configured cache backend and calls flush() with no is_user_logged_in, current_user_can('manage_options'), or wp_verify_nonce. The admin settings page exposes this as a GET link (admin-ajax.php?action=QPlayer2&do=flush) with no nonce, so an unauthenticated visitor or a CSRF img/GET can truncate wp_{prefix}QPlayer2, delete Redis keys QPlayer2_*, or bump the Memcached prefix. On exception the handler prints the message and stack trace as HTML. The music-proxy branch of the same action (server/type/id) is intended public and is not this finding.

  QPlayer2_Ajax.php:16-35

  Recommendation

  Split flush off the public music AJAX action. Require current_user_can('manage_options') and check_ajax_referer before Cache::flush(); change the settings-page control to a POST with a nonce. Do not print exception traces to unauthenticated clients.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.