LINE Connect WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

4.7.2

Findings

3

Worst severity

high

Content hash

72608026a7300548c7e6547c… Copy

Findings

• high LINE attachments saved under public uploads with executable/script extensions

  rce

  After a valid LINE signature, Webhook::handle downloads image/video/audio/file content and File::getMessageContent maps the LINE Content-Type through MIME_MAP onto a filename under wp-content/uploads/lineconnect/attachments/{prefix}/{Y/m}/{shard}/. MIME_MAP includes application/x-httpd-php and several other PHP types → .php, text/html → .html, application/x-javascript → .js, image/svg+xml → .svg. FileSystem::make_lineconnect_dir intentionally overwrites any existing deny-from-all .htaccess with only 'Options -Indexes', and writes a 0777 directory with no php_flag engine off. The resulting URL is world-readable. A LINE friend who can get the official account to receive a file whose Content-Type is one of those types plants a webshell or stored XSS on the site origin. Observable: GET /wp-content/uploads/lineconnect/attachments/.../YYYYMMDD-HHMMSS-<rand>.php (or .html) executes/renders in the visitor/admin browser.

  src/Bot/File.php:123-248

  Recommendation

  Allow-list image/audio/video MIME types only; never map to php/phtml/html/js/svg. Store outside the web root or keep Deny from all and serve via a manage_options download handler. Add php_flag engine off (Apache) / equivalent. Validate magic bytes, not only Content-Type.

• high Stored XSS in Event Log from unauthenticated LINE message text

  xss_stored

  Webhook writes LINE message JSON (and profile displayName) into lineconnect_bot_logs / line_id. Bot\Log\ListTable::column_message returns mb_substr($message['text']) with no esc_html; column_user_id returns displayName raw. WP_List_Table echoes those cells on admin.php?page= (Event Log), which is a manage_options page. A LINE friend sends text such as <img src=x onerror=…> or <script>…</script>; when an administrator opens Event Log the payload runs in the admin origin (session tokens are HttpOnly but the XSS can CSRF plugin settings, create an admin user, or plant a plugin). UserColumnCustomizer similarly concatenates LINE displayName into an HTML title/link on the Users list. No frontend script-evaluating consumer is required — this is a PHP HTML echo.

  src/Bot/Log/ListTable.php:295-337

  Recommendation

  esc_html() (or wp_kses with an empty allow-list) every LINE-sourced string before echoing in admin tables and user columns.

• medium Chat-log shortcode dumps other users' conversations and renders unsanitized Markdown HTML

  information_disclosure

  add_shortcode('line_connect_chat_gpt_log') is available to any Author who can publish posts. If user_id is omitted, wp_parse_args sets it to null, isset() is false, and the query has no user filter — every event_type=1 row is printed on a public page. If user_id is any LINE id (not current_user), that user's logs are shown to whoever views the post. Message text is passed through cebe\markdown\GithubMarkdown::parse() (HtmlTrait allows raw HTML) and concatenated into the returned markup with no wp_kses. A LINE user can therefore XSS every visitor of a page that contains the shortcode, and an Author can publish [line_connect_chat_gpt_log] to exfiltrate the whole bot log table (PII, prompts, admin replies).

  src/Shortcodes/Shortcodes.php:51-176

  Recommendation

  Default the shortcode to current_user only; require manage_options (or a dedicated cap) to pass an arbitrary user_id or omit the filter. Escape or wp_kses_post the markdown output; disable raw HTML in the parser.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.