Ngrok Bedrock WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.0.1

Findings

1

Worst severity

medium

Content hash

8c5bfc8812186ef6279ddf7c… Copy

Findings

• medium Unauthenticated page rewrite via file_get_contents of current Host URL (dev tool)

  dev_tool_in_production

  When WP_ENV is development, template_redirect uses file_get_contents on protocol+SERVER_NAME+REQUEST_URI (with wp_ngrok_autoload) and echoes the result after string replace. Any visitor can trigger an internal HTTP fetch of an arbitrary path on the same host. This is intentional for ngrok relative URLs but is a production risk if WP_ENV is mis-set, and expands attack surface (request amplification / Host-header confusion depending on server config).

  ngrok-local.php:29-47

  Recommendation

  Never enable on production; gate behind a constant that cannot be true in staging/prod; avoid echoing full fetched HTML; prefer output buffering/relative URL filters instead of secondary HTTP fetch.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.