Critical findings.

Audited release

1.2.2

Findings

1

Worst severity

critical

Content hash

bac5dc7a34443fd9f1363ed4… Copy

Findings

• critical LRS username/password embedded in public plugin JS file

  information_disclosure

  h5pxapi_generate_config_file base64-encodes lrs_username:lrs_password into window.H5PxAPIConfig.lrsAuth and file_put_contents them to H5PXAPI_PLUGIN_DIR/js/config.js, which is then enqueued for H5P embeds. That path is under wp-content/plugins and is world-readable over HTTP. Any visitor can fetch config.js, decode Basic auth, and fully access the configured Learning Record Store. Generation also writes the current user's display_name and mailto email into the same public file when an authenticated user triggers regeneration.

  h5p-xapi-enhanced.php:485-513

  Recommendation

  Never place LRS secrets in a static web file. Proxy xAPI statements through a server-side authenticated endpoint; keep credentials in options accessible only to PHP.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.