Nera – Strike A Win WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.4

Findings

3

Worst severity

high

Content hash

d59c4765c085d8e64ac12cf0… Copy

Findings

• high Answer key sent to player's browser and client-reported scoring via /submit-all

  information_disclosure

  Nera_SAW_Run::start() and resume() populate $state['slots'] with bulk_slots_payload_experimental_with_answers(), which includes 'answer_key' => correct_index ^ obfuscation_seed, and the obfuscation_seed is returned in the same JSON. The shipped dist bundle decodes it and posts all answers in one call to POST /nera-saw/v1/run/{id}/submit-all, which (submit_all_experimental) marks slots correct based solely on the client's chosen_index with no per-question deadline/served_at check, then finalizes and mints draw tickets. The code's own docblock acknowledges the key is 'trivially readable via the browser's own Network tab'. Any logged-in customer who has bought a run can read every correct answer and obtain the maximum ticket allocation in a real-money prize draw, defeating the skill element and the timer.

  includes/class-run.php:104-116, 551-640, 651-715

  Recommendation

  Revert to bulk_slots_payload() (no answer data) and server-scored per-question /answer with server-owned deadlines; remove or disable the /submit-all route and the experimental payload in production builds.

• medium Question bank import/export gated only by edit_posts (Contributor+ can rewrite or export the answer key)

  missing_capability

  All question import/export AJAX handlers check only current_user_can('edit_posts'). apply_chunk()/apply_row() call wp_insert_post() with a caller-chosen post_status (default 'publish', bypassing publish_posts) and wp_update_post()/update_post_meta(META_ANSWERS) on any question ID supplied in the CSV, without edit_post/edit_others_posts checks. The export handlers write a CSV including the 'correct' column for all questions. A Contributor, Author or Shop Manager can therefore alter which answer is correct in live competitions, inject published questions, trash the last import batch, or export the full answer key.

  includes/admin/class-question-import-admin.php:342-467

  Recommendation

  Require manage_options (or a dedicated capability) for import/apply/undo/export, and check edit_post per updated ID / publish_posts for published creates.

• low Published question text enumerable unauthenticated via core REST

  information_disclosure

  The question CPT is public=false but show_in_rest=true with capability_type=post, so WP_REST_Posts_Controller allows anyone to list published questions (title/content) at /wp/v2/<post type>. Answer meta is not registered for REST, so correct answers are not exposed, but the full question bank can be harvested ahead of a run.

  includes/class-question-cpt.php:78-96

  Recommendation

  Disable show_in_rest or add a rest permission filter limiting reads to editors.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.