Medium-severity findings.

Audited release

7.1.2

Findings

4

Worst severity

medium

Content hash

eadef31a4eab7fd7c6e4d5b1… Copy

Findings

• medium [phpinclude] shortcode includes arbitrary theme-relative PHP with path traversal

  file_access

  PHP_Include is registered as [phpinclude] whenever a plugin page template loads shortcodes.php. The file attribute is concatenated into get_theme_root()/get_template()/$file.php and include()'d with no basename(), realpath() prefix check, or capability gate. The plugin itself calls [phpinclude file='page'] from all three public templates, which also registers the shortcode for the rest of that request (the_content, widgets). Anyone who can put shortcodes on those pages (edit_pages: Editor+, and on Multisite Editors lack unfiltered_html but can still insert shortcodes) can include ../../../wp-config.php or other .php files outside the theme. Combined with any writable PHP (compromised upload, plugin file), this is RCE; standalone it is local file inclusion of executable PHP. Subscriber cannot insert the shortcode; this is still below manage_options.

  shortcodes.php:65-74

  Recommendation

  Do not expose include() as a shortcode. Hardcode the theme page.php include in the templates. If a file parameter must exist, allowlist a fixed set of names and reject .. and directory separators.

• medium Invitation codes are sequential and the next value is printed in public JavaScript

  predictable_token

  javascript_shortcode (hooked onto Exhibitors Code Maker via add_additional_js_content on the_content) counts rows in wp_gf_entry for get_option('form_id') and sets the hidden Gravity Forms .code field to code_prefix concatenated with (count+1). That assignment is inline JS on a public page, so any visitor learns PREFIX and the next sequence number. Prior codes PREFIX1…PREFIXN-1 are then accepted by page-checkform.php (SQL meta_value match or list/CSV) and unlock the visitor or VIP registration form. The readme documents this scheme (prefix + amount of exhibitors). Consumer is the Visitor Code Checker gate: the plugin's only authorization check for registration. No rate limit or unguessable token (wp_generate_password / CSPRNG) is used.

  shortcodes.php:102-123

  Recommendation

  Generate invitation codes with wp_generate_password / random_bytes, store a hashed lookup, and do not print the next code in page source. Rate-limit checker guesses. Do not treat every Gravity Forms meta_value as a valid code.

• medium Invitation-code CSVs are stored as publicly reachable upload URLs

  information_disclosure

  csv_file_upload / vip_csv_file_upload pass the admin-selected file to wp_handle_upload() and persist $urls['url'] (typically https://site/wp-content/uploads/YYYY/MM/filename.csv) in options csv_file and vip_csv_file. page-checkform.php fopen()s those options on every Visitor Code Checker request to build the valid-code arrays. WordPress uploads are world-readable; the original filename is kept, so a guessed or crawled /wp-content/uploads/…/codes.csv (or directory listing) dumps every exhibitor and VIP invitation code. Those codes are the secret that prepend_user_form / prepend_vip_form use to reveal the registration Gravity Forms. Upload is manage_options + options.php nonce (not subscriber-reachable); the confidentiality failure is the storage location.

  form_exhibit_ids.php:561-582

  Recommendation

  Store code lists in a directory protected by web-server rules (or as a private option/attachment with no public URL). Persist a filesystem path, not the public URL, and fopen that path. Restrict upload mimes to csv/txt.

• low Invitation-code lookup interpolates $_GET into mysqli queries without a prepared statement

  unsafe_input

  page-checkform.php and page-checkformexhibitor.php assign $passcode from $_GET['input_value'] (strtoupper on the visitor template) and concatenate it into SELECT * FROM `wp_gf_entry_meta` WHERE `meta_value` = '$passcode' …. javascript_shortcode does the same with get_option('form_id') into wp_gf_entry. Queries run over a raw mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) with no mysqli_real_escape_string / $wpdb->prepare and hardcoded wp_ table prefixes. These files run as WP page templates, so wp_magic_quotes() has already addslashes()'d $_GET; there is no wp_unslash and the value sits in a quoted string, so this is not currently exploitable as SQL injection on a default install. It remains unsafe input: a future stripslashes, a different charset, or loading the template without WP bootstrap would make it SQLi, and the checker is unauthenticated.

  page-checkform.php:34-46

  Recommendation

  Use $wpdb->prepare() (or mysqli prepared statements) with the real $wpdb->prefix. Cast form IDs with absint(). Abort if input_value is missing instead of interpolating null.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.