PS Easy Blogging WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.4

Findings

2

Worst severity

high

Content hash

363263a4bb90379a4dfe6707… Copy

Findings

• high Missing auth and nonce on Easy Blogging module activate/deactivate AJAX

  missing_capability

  json_activate_plugin and json_deactivate_plugin are registered on wp_ajax_wdeb_activate_plugin / wp_ajax_wdeb_deactivate_plugin and immediately call Wdeb_PluginsHandler::activate_plugin/deactivate_plugin using unsanitized $_POST['plugin']. There is no current_user_can check and no check_ajax_referer/nonce. Any authenticated user (Subscriber-or-equivalent) can toggle modules listed under lib/plugins, persisting changes in the network/site option wdeb_activated_plugins and causing those PHP modules to load (or stop loading) on subsequent requests. CSRF against a logged-in victim also works.

  lib/class_wdeb_admin_pages.php:733-747

  Recommendation

  Require current_user_can('manage_options') (or manage_network_options on multisite) and check_ajax_referer before mutating wdeb_activated_plugins; also sanitize the plugin slug against get_all_plugins().

• high CSRF on Easy Blogging module activate/deactivate AJAX

  csrf

  The same activate/deactivate AJAX handlers lack any nonce verification. A malicious page can force a logged-in user’s browser to toggle Easy Blogging modules via admin-ajax.php.

  lib/class_wdeb_admin_pages.php:817-818

  Recommendation

  Add check_ajax_referer with a dedicated action and send the nonce only to authorized admins.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.