Nticstudio Backup WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.0.0

Findings

2

Worst severity

medium

Content hash

1037401daff6dbe174026e90… Copy

Findings

• medium CSRF on SFTP connection test

  csrf

  nticstudio_backup_test_page() runs nticstudio_backup_test_sftp() whenever $_POST['nticstudio_backup_test'] is set, with no check_admin_referer and no explicit capability check in the handler. An admin visiting a malicious page can be forced to initiate an SFTP upload/delete test using stored credentials.

  wp-nticstudio-backup.php:277-293

  Recommendation

  Add wp_nonce_field/check_admin_referer and current_user_can('manage_options') before testing.

• medium mysqldump invoked with unescaped DB credentials via exec()

  insecure_config

  nticstudio_backup_run() builds a mysqldump shell command with sprintf using raw DB_HOST/DB_USER/DB_PASSWORD/DB_NAME; only the output path uses escapeshellarg(). Credentials appear on the process command line, and metacharacters in DB_PASSWORD can break the shell. Prefer a PHP-native dumper or escape every shell argument.

  wp-nticstudio-backup.php:61-71

  Recommendation

  Pass all arguments through escapeshellarg, use --password via env/defaults-file, or dump via $wpdb/PHP without a shell.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.