SC-Importer WP Registry grade F. Critical findings · 3 findingsWP RegistryCritical findings · 3 findingsOpen the reportF

Critical findings.

Audited release

0.0.1

Findings

3

Worst severity

critical

Content hash

3046493d2be292117591d483… Copy

Findings

• critical Hardcoded database credentials in plugin source

  hardcoded_credentials

  SC_Importer_Plugin defines DB_User='rrebost', DB_Pass='mypasswd', DB_Name='rebost' as class constants and uses them in mysqli_connect from unauthenticated ajax. Credentials are world-readable in the plugin zip and usable against any host where that MySQL account exists.

  sc-importer.php:15-17

  Recommendation

  Remove hardcoded credentials; load from wp-config / environment; rotate the exposed password.

• critical Unauthenticated AJAX import handlers with no nonce or capability checks

  missing_auth

  Five import actions (rebost_import, wordpressids_import, taxonomies_import, projectes_import, aparells_import) are registered for both wp_ajax_ and wp_ajax_nopriv_ with zero current_user_can, check_ajax_referer, or other auth. Unauthenticated visitors can trigger bulk content/DB imports and schema changes.

  sc-importer.php:24-34

  Recommendation

  Remove nopriv hooks; require manage_options + check_ajax_referer on every import handler.

• critical SQL injection via interpolated post titles in external DB queries

  sql_injection

  sc_wordpressids_import builds SQL with double-quoted interpolation of $programa_title and $rebost_id from WordPress posts into mysqli queries (bypassing $wpdb). Titles with quotes break out of the SQL string. Combined with missing auth, this is remotely exploitable against the configured MySQL database.

  sc-importer.php:122-136

  Recommendation

  Use mysqli prepared statements; never interpolate post titles into SQL.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.