CWP Snippets WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.2.0

Findings

2

Worst severity

high

Content hash

1ba886ccc1c81f02e21596a8… Copy

Findings

• high Legacy integration mode authorizes unauthenticated cache-clear and download-proxy requests by default

  auth_bypass

  Activation writes cwp_snippets_legacy_integration_mode=1. cwp_is_integration_request_authorized() treats a missing token as success whenever that option is '1', even if a 64-byte API token is already stored. That helper is the only gate on nopriv AJAX cwp_clear_cache, nopriv AJAX fm_download, and REST POST /cwp/v1/clear-cache. An unauthenticated visitor who omits credentials can therefore wipe transients or ask the site to fetch an arbitrary HTTPS URL (wp_http_validate_url / wp_safe_remote_get for public hosts; allowlisted private FileMaker hosts skip that SSRF filter) and stream the body as a download. The admin UI itself labels this a security warning, but the default is on.

  includes/functions.php:164-239

  Recommendation

  Default legacy mode to off on new installs; require the configured token (or manage_options) for every integration route; reject empty tokens even when legacy is temporarily enabled.

• high Unauthenticated FileMaker download handler is an open HTTPS file proxy

  ssrf

  handle_filemaker_download() is registered for wp_ajax_nopriv_fm_download and authorizes via the same legacy-mode helper. The attacker supplies url and filename. Public HTTPS URLs pass wp_http_validate_url and are fetched with wp_safe_remote_get (up to 25MB) then echoed with Content-Disposition attachment. Combined with default-on legacy mode this is a world-reachable open proxy. If an admin later allowlists private FileMaker hosts, the same unauth path skips wp_http_validate_url and uses wp_remote_get with redirection=0 against those hosts.

  includes/functions.php:1131-1217

  Recommendation

  Require a valid integration token (never legacy empty-token) on fm_download; restrict URLs to the configured host allowlist only; do not stream arbitrary public HTTPS bodies to unauthenticated clients.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.