OA Dues Lookup WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.7.1

Findings

2

Worst severity

high

Content hash

7254e2c341bc81a1d339dc2f… Copy

Findings

• high Subscriber+ can replace the public dues roster via ungated import AJAX

  missing_capability

  add_submenu_page for Import Dues requires manage_options, but the handlers the upload widget actually calls do not. oalm_process_import_upload (wp_ajax_ only) accepts any logged-in user’s multipart file whose client filename ends in .xlsx, and move_uploaded_file’s it to wp-content/uploads/dues-lookup/import.xlsx with no current_user_can, no check_ajax_referer, and no MIME/content check. oalm_import_status likewise has no cap/nonce: if that file exists and oadueslookup_import_status is waiting and cron is off, it sets ignore_user_abort(true), set_time_limit(0), and include’s bin/dues-import-processor.php. The processor TRUNCATEs {$prefix}oalm_dues_data and INSERTs the spreadsheet rows (PhpSpreadsheet Xlsx reader, setReadDataOnly), then the public [oadueslookup] shortcode SELECTs that table for any Member ID. oalm_ack_complete unlinks the file and resets the option, also with no cap/nonce. The processor file additionally require_once’s wp-load.php when hit directly over HTTP and performs the same TRUNCATE with no is_user_logged_in check, so processing after a Subscriber upload does not need a session. Observable: a Subscriber POSTs admin-ajax.php?action=oalm_process_import_upload with a crafted xlsx, then action=oalm_import_status, and every visitor of the lookup page sees attacker-controlled dues/honor/registration data; a large xlsx is an unbounded parse. JS on the admin import screen is not a gate.

  includes/dues-import.php:106-165

  Recommendation

  In all three AJAX callbacks, require current_user_can('manage_options') and check_ajax_referer before touching the filesystem or including the processor. Localize a nonce to the upload widget. Guard bin/dues-import-processor.php so HTTP requests are rejected unless included from this plugin (php_sapi_name() === 'cli' || a defined internal constant). Do not run set_time_limit(0) for unprivileged users.

• high CSRF on settings can retarget the public pay-dues URL

  csrf

  oadueslookup_options() is the manage_options settings page. After the capability check it treats a POST with hidden field oalm_submit_hidden=oadueslookup-settings as a save: it reads oadueslookup_dues_url, oadueslookup_update_url, oadueslookup_help_email, oadueslookup_dues_register_msg, and related fields, sanitizes (esc_url_raw / sanitize_email / sanitize_text_field), and update_option’s them. The form has no wp_nonce_field, and the handler never calls check_admin_referer or wp_verify_nonce. A cross-site POST while an administrator is logged in writes those options. Consumer: includes/user-facing-lookup-page.php prints get_option('oadueslookup_dues_url') as the “pay your dues” / “pay them here” href for every shortcode visitor (line 46 is echo get_option with no esc_url). Observable: attacker CSRF form with oadueslookup_dues_url=https://evil.example/pay causes every member who follows the lookup CTA to leave the lodge site for the attacker’s payment page. oadueslookup_update_url and oadueslookup_help_email (mailto) are the same class of front-end sinks from this write.

  includes/management-options-page.php:45-118

  Recommendation

  Add wp_nonce_field to the settings form and check_admin_referer() before any update_option. Keep the manage_options gate. Echo oadueslookup_dues_url / oadueslookup_update_url with esc_url() on the front end (the unescaped echo on user-facing-lookup-page.php line 46).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.