Zammad for WordPress WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.9.1

Findings

1

Worst severity

high

Content hash

613919aca9303a93af5605e5… Copy

Findings

• high Public HTML Forms action file_get_contents attacker-controlled tmp_name/dir paths into a Zammad ticket

  file_access

  zammad_hf_process_form_action is hooked to hf_process_form_action_zammad and runs for every unauthenticated HTML Forms submit whose form action type is zammad (HTML Forms registers wp_ajax_nopriv_hf_form_submit; this plugin adds no capability or nonce of its own). It walks $submission->data, treats any value for which hf_is_file() is true (array with name, size, and type — not is_uploaded_file()) as an attachment, and passes it to zammad_hf_prepare_attachments(). That helper does file_get_contents($file['tmp_name'] ?? trailingslashit($file['dir']).$file['name']) with no path allowlist, basename(), or URL-scheme block, then base64-encodes the bytes onto a ticket created with the site's Zammad API token. HTML Forms get_request_data() starts from $_POST and only overwrites keys that also exist in $_FILES, so a public POST can turn a non-file field (e.g. MESSAGE) into {name, size, type, tmp_name: '/var/www/html/wp-config.php'} or tmp_name=http://169.254.169.254/latest/meta-data/ while leaving EMAIL as a string. array_change_key_case() only uppercases top-level keys, so nested tmp_name/dir survive. Observable: the file or SSRF response is stored as a ticket article attachment in Zammad for the customer matching the submitted email (and may leave the host via Zammad notifications). Requires HTML Forms plus a form with the Zammad action, which is this plugin's documented integration, not a third-party bug.

  includes/functions/hf-plugin-integration.php:140-147,268-285

  Recommendation

  Only accept attachments that originated in $_FILES. Require is_uploaded_file($file['tmp_name']) before reading, or for Premium stored files resolve realpath() and reject anything outside the HTML Forms upload directory; never concatenate raw name onto dir. Block URL wrappers (http(s), ftp, phar, data). Use basename() on filenames sent to Zammad. Do not treat arbitrary POST arrays that happen to contain name/size/type as files.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.