Medium-severity findings.

Audited release

0.0.3

Findings

1

Worst severity

medium

Content hash

5af18203938e0c0b14124a09… Copy

Findings

• medium CSRF via GET quickaction=purge wipes debug.log (capability checked, nonce absent)

  csrf

  process_debug_type is hooked to admin_init and, after current_user_can('manage_options') and is_admin(), treats $_GET['quicklook'] plus $_GET['quickaction'] in {view,purge} as the entire authorization story. There is no wp_verify_nonce, check_admin_referer, or check_ajax_referer anywhere in the plugin. admin_bar_links builds predictable URLs with add_query_arg(array('quicklook'=>1,'quickaction'=>'purge'), admin_url('/')) and no nonce query arg. Because the action is a GET, a cross-site top-level navigation (anchor, redirect) sends SameSite=Lax wordpress_* cookies and truncates WP_CONTENT_DIR.'/debug.log' via file_put_contents($file, ''). Subscriber and other non-admin roles cannot invoke this themselves; an unauthenticated attacker needs a logged-in administrator to follow the link. Blast radius is the debug log only (evidence/secret wipe, not RCE or settings). The later WP Debugging vendor fork of this code added wp_verify_nonce($_GET['nonce'], 'debug_quicklook_{action}_action') on the same admin_init path; tag 0.0.3 never received that check.

  debug-quick-look.php:126-235

  Recommendation

  Require a nonce on both view and purge. Generate it in admin_bar_links (wp_create_nonce('debug_quicklook_' . $action . '_action')), append it to the admin_url query args, and call wp_verify_nonce on process_debug_type before touching the file. Prefer POST (or admin-post.php) for purge so SameSite=Lax blocks cookie-sending CSRF. Keep the manage_options gate. Escape log bytes with esc_html() rather than wp_kses_post when rendering view.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.