WW Yubico OTP Authentication WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

3.0.1

Findings

1

Worst severity

high

Content hash

6d450fb7e1f311762be55577… Copy

Findings

• high YubiKey OTP is not enforced outside wp-login.php, allowing XML-RPC password auth

  auth_bypass

  Plugin::init() is the only bootstrap. It attaches Login::instance to login_form_login and does not add the authenticate filter on init. Login's constructor is the sole add_filter('authenticate', ..., 999) call. login_form_login is fired only from wp-login.php when action=login, so xmlrpc.php, application-password REST (determine_current_user), and any plugin/theme wp_authenticate/wp_signon path never load OTP_Utils::enabled_for / verify_code. Core wp_xmlrpc_server::login() still calls wp_authenticate($username, $password) with the account password. On a default install xmlrpc_enabled is true, so an attacker who has an enrolled user's password (stuffing, reuse, phishing) can POST /xmlrpc.php (wp.getUsersBlogs, system.multicall brute force, wp.newPost, wp.uploadFile, wp.editProfile, wp.newUser) and operate as that user with no YubiKey OTP in the request. This is the control the plugin exists to provide; scoping it to the login-form UI class leaves the default XML-RPC password channel wide open. wp-login.php remains protected (password then OTP). Application Passwords via REST are a separate core token and are noted only as additional ungated surface.

  inc/class-plugin.php:16-20

  Recommendation

  Hook authenticate (or an equivalent fail-closed check) on init/plugins_loaded for every request, not only inside the login-form UI class. Keep login_enqueue_scripts/login_form on login_form_login. For XML-RPC and other password-based API auth, reject the login when OTP is enabled for that user unless a valid YubiKey OTP is presented, or disable password XML-RPC for enrolled users and require Application Passwords (the WordPress/two-factor approach). Do not treat a missing yotp POST field as 'OTP not required' outside the login form.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.