AJC Bridge WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.4.0

Findings

2

Worst severity

high

Content hash

251da12b998b4aec2150b9f1… Copy

Findings

• high Author+ SSRF via GitHub image sync (prefix-only local URL check + wp_remote_get)

  ssrf

  When a published post is synced to GitHub (automatic on publish/update, or wp_ajax_jamstack_sync_now which only requires edit_post), Media_Processor::get_post_images_data extracts every <img src> from raw post_content. is_local_image() allows the URL if strpos($url, site_url()) === 0 — a prefix match, not a host parse. An Author can insert (kses allows img src) https://{site_host}@{internal}/path, https://{site_host}.attacker.tld/..., or similar. download_image() then calls wp_remote_get() with stream-to-file and no reject_unsafe_urls (wp_safe_remote_get is never used anywhere in the plugin). WordPress HTTP will treat userinfo@host as the real destination, including 169.254.169.254 and RFC1918. If Intervention cannot encode the body as WebP/AVIF, get_single_image_data copies the raw downloaded bytes into the atomic-commit payload and Git_API::create_atomic_commit pushes them with the administrator-stored PAT. Subscriber/customer cannot publish or hit the AJAX. Requires a GitHub publishing strategy (github_only or dual_github_devto).

  core/class-media-processor.php:692-806

  Recommendation

  Parse the URL and compare scheme+host (and optional port) to home_url()/site_url(); reject userinfo, non-http(s), and hosts that fail wp_http_validate_url(). Fetch with wp_safe_remote_get(), do not follow redirects off-site, cap size, and require a real image MIME/type before any GitHub upload. Do not fall back to committing the original bytes when encoding fails.

• medium Debug logs in uploads with predictable names and Apache-only protection

  information_disclosure

  When ajc_bridge_settings[debug_mode] is enabled, Logger::write_to_file() appends to wp-content/uploads/ajc-bridge-logs/ajc-bridge-{Y-m-d}.log. Directory protection is an Apache 2.2 'Deny from all' .htaccess plus index.php; there is no nginx/LiteSpeed rule and no random component in the filename. Git_API logs full GitHub JSON bodies and response headers; DevTo_Adapter/DevTo_API log front matter and the markdown payload. On hosts that ignore .htaccess, an unauthenticated client can GET the guessable log URL and read private-repo metadata and post content. Debug is admin-opt-in (off by default) but is a first-class settings checkbox, not a hidden WP_DEBUG dependency.

  core/class-logger.php:90-129

  Recommendation

  Do not store logs under a web-reachable uploads path. If files are required, place them outside the docroot or behind a unique unguessable directory, send application/octet-stream + deny headers, and add an nginx-compatible deny. Never log full API response bodies; redact tokens, headers, and markdown. Prefer the existing ajc_bridge_logs option (admin-only) over world-readable files.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.