Gravity Forms Eloqua WP Registry grade F. Critical findings · 6 findingsWP RegistryCritical findings · 6 findingsOpen the reportF

Critical findings.

Audited release

1.6.0d

Findings

6

Worst severity

critical

Content hash

307782050fd2ef31bdfd696a… Copy

Findings

• critical Unauthenticated write of Eloqua OAuth/Basic credentials via init() settings side-effects and OAuth callback

  missing_auth

  GFEloqua::init() (hooked from GFAddOn on every front-end and admin request) calls _maybe_store_settings() and _maybe_clear_settings() before any capability or nonce check. is_save_postback() is true whenever $_POST['gform-settings-save'] is non-empty. generate_oauth_token() then reads $_POST['gfeloqua_oauth_code'], exchanges it at login.eloqua.com using the plugin's client secret, and update_option's gfeloqua_oauth_token and gfeloqua_oauth_refresh_token. The same postback can set gfeloqua_auth_basic, delete the OAuth token, plant a Basic authstring from _gaddon_setting_sitename/username/password, or wipe all credentials via _gaddon_setting_eloqua_disconnect=1. A parallel path, handle_oauth_code on admin_init, accepts GET gfeloqua-oauth-code with no auth; admin-ajax.php fires admin_init without auth_redirect, so an unauthenticated GET is enough. Combined with the hardcoded client_id and the live proxy at api.briandichiara.com (302 Location: https://{state}?gfeloqua-oauth-code={code}, no allowlist), an attacker completes Eloqua OAuth as themselves with state=victim/wp-admin/admin-ajax.php?action=1 (or POSTs the code to the victim front end) and the victim site stores the attacker's tokens. Observable consequence: Eloqua_API::connect() Authorization header now authenticates as the attacker, so process_feed() POST data/form/{id} delivers every subsequent Gravity Forms lead to the attacker's Eloqua instance. Upstream has been unmaintained since 2018.

  gfeloqua.class.php:51-58,446-469,1038-1116,1124-1197

  Recommendation

  Never exchange or store Eloqua tokens outside a manage_options / gravityformseloqua capability check plus a CSRF nonce bound to that admin user. Reject OAuth codes unless they match a short-lived state nonce created when the admin clicked Authenticate. Do not run settings-save side effects from init(); keep them in the GF settings-page callback. Rotate the leaked OAuth client and stop using a third-party open-redirect proxy as redirect_uri.

• high Hardcoded Eloqua OAuth client_id and client_secret with third-party redirect_uri

  hardcoded_credentials

  Eloqua_API ships a production OAuth client_id, client_secret, and redirect_uri to https://api.briandichiara.com/gravityformseloqua/ as public class properties. Anyone can start https://login.eloqua.com/auth/oauth2/authorize?client_id=11c8590a-...&redirect_uri=https://api.briandichiara.com/gravityformseloqua/&state=<arbitrary>. The proxy still 302s to https://{state}?gfeloqua-oauth-code={code} with no host allowlist, so the authorization code for this shared app can be delivered to an attacker server or to a victim admin-ajax URL. The secret is also embedded in the token URL as https://client_id:client_secret@login.eloqua.com/..., so it appears in PHP/http logs. This is not a per-site secret; it authenticates the plugin as an Eloqua app for every install and is the credential generate_oauth_token() uses to mint access_tokens that are then stored in gfeloqua_oauth_token.

  api/class.eloqua.api.php:24-30

  Recommendation

  Revoke this Eloqua app immediately. Require each site to register its own OAuth application (or use a server-side confidential client that never ships in plugin source) with a redirect_uri on the site itself. Treat the published secret as compromised; rotate and do not commit replacements.

• high Stored admin XSS via unescaped Eloqua debug notes (unauth form fields → jQuery.html / entry detail)

  xss_stored

  process_feed() stores a GFEloqua_Debug_Data object whose value is the Eloqua submission payload, including attacker-controlled Gravity Forms field values. get_data_as_notes() var_dump/string-concatenates that value into HTML with no escaping and writes it to entry meta gfeloqua_notes. views/notes-display.php printf's those strings into the wp-admin entry detail table. On failed sends (or when gfeloqua-notes is in the query string) that HTML is rendered to anyone who can view GF entries. The retry AJAX success handler also does $('#gfeloqua-notes').html(response.notes), which executes event-handler XSS and, in this jQuery usage, injected markup. An unauthenticated visitor submits <img src=x onerror=...> or <script> in a mapped field; if the Eloqua POST fails (including after the unauth disconnect in finding 1) an administrator viewing or retrying the entry executes the payload in wp-admin, i.e. session takeover. Keys are attacker-controlled strings; values are not passed through esc_html.

  includes/gfeloqua-debugger.class.php:26-56

  Recommendation

  Escape every note fragment with esc_html (or wp_kses with an empty allowed-html set) before storage and before echo. Return notes as JSON text to the retry AJAX and insert with .text(), not .html(). Do not dump raw submission objects into admin HTML.

• medium Subscriber AJAX IDOR: reset/resubmit any Eloqua-mapped entry and read PII debug notes

  missing_capability

  wp_ajax_gfeloqua_reset_entry and wp_ajax_gfeloqua_resubmit_entry are registered without a nopriv twin, so WordPress only requires is_user_logged_in(). There is no current_user_can('gravityforms_view_entries'), no gravityformseloqua cap, and no nonce. reset_entry() gform_update_meta's gfeloqua_success to 'Failed.' for attacker-chosen entry_id/form_id. resubmit_entry() then GFAPI::get_entry / get_feeds / process_feed and wp_send_json's the HTML notes (full submission object, Eloqua last_response) plus retry count. A Subscriber enumerates integer IDs, resets successful entries, resubmits, and reads other users' form PII; the same calls also re-POST that PII to Eloqua. wp_ajax_gfeloqua_clear_transient similarly delete_transient('gfeloqua/'.sanitize_text_field($_GET['transient'])) with no auth. Localized JS on GF admin screens does not render a nonce, so a logged-in subscriber need only GET admin-ajax.php.

  gfeloqua.class.php:64-66,715-725,1598-1665,1826-1844

  Recommendation

  Gate all three AJAX actions on a Gravity Forms entry capability (gravityforms_view_entries / gravityformseloqua) and check_ajax_referer. Re-check that the entry belongs to a form that has an Eloqua feed and that the current user can view that entry. Do not return raw debug HTML to the client.

• medium OAuth token requests disable TLS verification and put the client secret in the URL

  insecure_config

  refresh_token() and generate_oauth_token() wp_remote_post to https://{client_id}:{client_secret}@login.eloqua.com/auth/oauth2/token with sslverify => false. A network-position attacker (broken MITM, captive portal on a misconfigured host, local HTTP proxy) can read the Basic auth in the URL and the JSON access_token / refresh_token in the response, then write those values into gfeloqua_oauth_token the same way the plugin does — or simply use them against Eloqua. The shipped lib/cacert.pem bundle is unused. This is the same request that stores the site's Eloqua session.

  gfeloqua.class.php:384-403,1146-1164

  Recommendation

  Leave sslverify at the WP default (true). Pass the client secret in an Authorization: Basic header or POST body, not the URL userinfo field.

• low Plugin is explicitly unmaintained (GitHub, tested up to WordPress 4.5.1)

  unmaintained

  readme.txt lists Tested up to: 4.5.1 and the public GitHub README states the repository will no longer be maintained in favor of a premium rewrite. Last functional commits on solepixel/gravityforms-eloqua are from 2016 (premium-announcement commit 2018). Combined with the ungated credential writers and hardcoded OAuth app, there is no upstream to ship a patch for sites still running this GitHub-distributed copy.

  readme.txt:1-6

  Recommendation

  Replace with a currently maintained Eloqua/Gravity Forms integration. Do not expect security fixes for this tree.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.