WP A/B Split WP Registry grade B-. Medium-severity findings · 6 findingsWP RegistryMedium-severity findings · 6 findingsOpen the reportB-

Medium-severity findings.

Audited release

0.2.0

Findings

6

Worst severity

medium

Content hash

55ce2fbc09e355c70eb78c3f… Copy

Findings

• medium Unauthenticated probe writes arbitrary conversion steps without auth or nonce

  missing_auth

  The same nopriv probe accepts POST user_id/userAction/description/id and INSERTs into {$wpdb->prefix}wpab_steps and UPDATEs wpab_executions with raw string interpolation. Even where magic-quotes blunt classic string SQLi, any visitor can forge conversion events and corrupt A/B results.

  include/class.wpab.php:611-640

  Recommendation

  Bind parameters with $wpdb->prepare/insert, validate execution_id ownership via opaque signed session token issued when the test starts, and rate-limit. Do not trust client-supplied user_id.

• medium Unauthenticated probe writes arbitrary conversion steps without auth or nonce

  missing_auth

  The same nopriv probe() accepts POST user_id/userAction/description/id and INSERT/UPDATEs wpab_steps and wpab_executions with no authentication, capability, or nonce. Attackers can poison conversion metrics and mark executions converted/closed.

  include/class.wpab.php:611-640

  Recommendation

  Authenticate tracking with a signed execution token bound to the session; use $wpdb->insert/$wpdb->prepare; reject unknown execution IDs.

• medium admin_action_wpab_report lacks capability check (IDOR-style report disclosure)

  missing_capability

  report() is hooked to admin_action_wpab_report and also used as a manage_options submenu callback. The callback itself never calls current_user_can(). Any authenticated user who can load wp-admin (including Subscriber via profile) can request admin.php?action=wpab_report&post=<id> and receive A/B conversion charts and counts for any test post.

  include/class.wpab.php:645-866

  Recommendation

  At the start of report(), require current_user_can('manage_options') (or edit_post on the test) and exit 403 otherwise; prefer only the submenu entry point.

• medium CSRF on toggle_test_status (no nonce)

  csrf

  toggle_test_status is hooked to post_action_toggle_test_status and flips wpab_test post_status between publish and pending without verifying a nonce. Core post.php enforces edit_post, but a logged-in editor/admin can be CSRF'd into starting/stopping tests.

  include/class.wpab.php:1009-1026

  Recommendation

  check_admin_referer before mutating status; use wp_nonce_url in row actions.

• low Raw request strings interpolated into SQL without prepare (magic-quotes mitigated)

  unsafe_input

  POST fields in probe() are concatenated into quoted SQL without $wpdb->prepare or wp_unslash. On default WP installs magic-quotes escape quotes, so this is unsafe coding rather than confirmed critical SQLi for those string fields.

  include/class.wpab.php:614-619

  Recommendation

  Use $wpdb->insert/$wpdb->prepare exclusively; never interpolate $_POST into SQL.

• low Raw request strings interpolated into SQL without prepare (magic-quotes mitigated)

  unsafe_input

  POST fields user_id/userAction/description/id are quote-wrapped into INSERT/UPDATE SQL without $wpdb->prepare or wp_unslash. Under WordPress magic-quotes this is not reliably exploitable as classic SQLi, but remains unsafe_input and will become critical if magic-quotes behavior changes or unslash is added carelessly.

  include/class.wpab.php:618-638

  Recommendation

  Use $wpdb->insert/$wpdb->update with placeholders; cast execution_id to int.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.