High-severity findings.

Audited release

1.4.3

Findings

1

Worst severity

high

Content hash

b9a1a3adce1d1d682e9517ab… Copy

Findings

• high Unauthenticated Gravity Forms entry archive/unarchive via admin_init

  missing_auth

  RS_Entry_Archives_Form hooks handle_archive_action to both admin_init and wp_ajax_rsea_archive. The handler reads $_GET['rsea_archive'] and $_GET['rsea_entry_id'] (cast to int), then calls archive_entry() or unarchive_entry() with no is_user_logged_in, current_user_can, or nonce check. archive_entry() is GFAPI::update_entry_property($id, 'status', 'archived'); unarchive_entry() always writes status 'active', so a request with rsea_archive=0 also restores spam and trash entries. GFAPI::update_entry_property() has no capability gate (only a submissions-block check, then $wpdb->update) and fires gform_update_status, which Gravity Forms feed add-ons use to re-process feeds on spam→active and which can create a WordPress post from the entry. admin_init runs on wp-admin/admin-ajax.php and wp-admin/admin-post.php before any authentication, so an unauthenticated GET such as /wp-admin/admin-ajax.php?action=heartbeat&rsea_archive=1&rsea_entry_id=1 (or rsea_archive=0) is sufficient; DOING_AJAX then causes wp_send_json_success and exit. A nonce named rsea-nonce is localized into admin JS but never attached to the GET and never verified. Logged-in Subscribers can hit the same path via wp_ajax_rsea_archive or any wp-admin page. Impact is integrity of every Gravity Forms entry (hide submissions from the default Active list, or un-spam/un-trash and potentially trigger feeds/post-creation), not RCE or a frontend XSS sink.

  classes/form.php:17-18,148-170,643-657

  Recommendation

  Remove the admin_init hook; keep a single wp_ajax_rsea_archive (and a matching admin-post handler only if a non-AJAX GET is still required). In the handler, require a logged-in user, verify the rsea-nonce that is already localized (check_ajax_referer / wp_verify_nonce), and require Gravity Forms' entry-edit capability (e.g. GFCommon::current_user_can_any('gravityforms_edit_entries') plus GFAPI::get_entry() success). Refuse to unarchive unless the current status is archived; never force-set spam/trash to active. Send the nonce from admin-general.js with the AJAX GET/POST. Prefer wp_nonce_url() on the row-action links if a non-AJAX fallback remains.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.