Low-severity findings only.

Audited release

3.9.12

Findings

1

Worst severity

low

Content hash

ca243fe7134d34cfef7cec93… Copy

Findings

• low Unauthenticated CSRF on admin_init ?force-check=1 clears the plugin-update cache

  csrf

  time_tracking_force_update_check is hooked to admin_init with no current_user_can, nonce, or even is_user_logged_in. Any request that runs admin_init with GET force-check=1 (strict) calls delete_site_transient('update_plugins') then wp_redirect(remove_query_arg('force-check')) and exit. That includes: (1) a Subscriber loading wp-admin/profile.php?force-check=1; (2) an unauthenticated GET to wp-admin/admin-ajax.php?action=heartbeat&force-check=1 (admin-ajax.php fires admin_init for nopriv actions; can be triggered by an img src). The parameter name is the same one WordPress core uses on update-core.php / plugins.php, so this also intercepts an administrator's legitimate 'Check again' before core can refresh core/theme updates. Blast radius is a site-wide cache reset plus extra GitHub API traffic on the next pre_set_site_transient_update_plugins, not a settings or file write.

  includes/update-github.php:283-290

  Recommendation

  Remove this handler or gate it with current_user_can('update_plugins') plus check_admin_referer on a plugin-specific query arg (not force-check). Prefer delete_site_transient + wp_update_plugins() on the existing manage_options tt_check_for_updates AJAX action only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.