High-severity findings.

Audited release

3.22.1

Findings

1

Worst severity

high

Content hash

887b8d8a28b080859f14c3ff… Copy

Findings

• high CSRF: nonce-less GET triggers CRIS page and menu synchronization

  csrf

  FAU_CRIS::options_fau_cris() treats a GET parameter action=cris_sync as a command to run Sync::do_sync(true). The callback is only reachable for users who pass the options page capability manage_options, but the request is a side-effecting GET with no wp_verify_nonce, check_admin_referer, or POST confirmation. A cross-site top-level navigation (works with WordPress SameSite=Lax auth cookies) to /wp-admin/options-general.php?page=options-fau-cris&tab=sync&action=cris_sync while an administrator is logged in starts a full sync: published pages are created or updated from CRIS research fields/projects, nav menus are created or rewritten (including set_theme_mod('nav_menu_locations') when the main-menu location is empty), and pages/menu items whose titles match 'Weitere Projekte' or CRIS project titles can be deleted via wp_delete_post. The sync checkbox only hides the UI button and controls cron; the GET handler runs even when automatic sync is disabled, as long as cris_org_nr is set. Upstream later versions wrap this action in wp_verify_nonce(..., 'fau_cris_tab_nonce').

  fau-cris.php:274-305

  Recommendation

  Require a nonce (e.g. check_admin_referer / wp_verify_nonce) and convert the sync trigger to POST. Keep the manage_options gate. Do not perform wp_insert_post/wp_delete_post/set_theme_mod on a mere GET of the settings screen. Upstream 3.29.x already added _wpnonce_tab verification for this action.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.