Starmus Audio Recorder WP Registry grade F. Critical findings · 5 findingsWP RegistryCritical findings · 5 findingsOpen the reportF

Critical findings.

Audited release

1.0.1

Findings

5

Worst severity

critical

Content hash

b32773a977589228e2115878… Copy

Findings

• critical Hardcoded TUS webhook secret allows unauthenticated arbitrary file delete and recording overwrite

  hardcoded_credentials

  StarmusTusdHookHandler is always registered from StarmusAudioRecorder::init_components as POST /wp-json/starmus/v1/hook. Authentication is only the x-starmus-secret header compared to STARMUS_TUS_WEBHOOK_SECRET. The main plugin file defines that constant to the public value 84d34624286938554e5e19d9fafe9f5da3562c4d1d443e02c186f8e44019406e whenever wp-config does not override it, and the same secret is printed in the file header as a tusd -hooks-http-header example. Comments claim default secrets are rejected; the code never does. permissions_check catch (Throwable) logs and then returns true, so an unexpected exception also authorizes the request. handle_post_finish passes Event.Upload.Storage.Path and MetaData straight into StarmusSubmissionHandler::process_completed_file. _finalize_from_local_disk treats Path as a local filesystem path on the WordPress host (not a remote TUS box): if the file exists and MIME is not in the audio allowlist, it unlinks the source; if MIME is audio, it moves the file into uploads, creates an attachment, and either overwrites an existing audio-recording (form_data post_id/recording_id, deleting the previous attachment) or wp_insert_post as form_data user_id. An unauthenticated client who knows the shipped secret can POST a JSON body with Path=/path/to/wp-config.php and delete it, or point Path at any existing audio file and attach it to an arbitrary recording. No current_user_can, nonce, or path allowlist on the source.

  src/includes/StarmusTusdHookHandler.php:100-124,303-347,389-417

  Recommendation

  Do not ship a default webhook secret. Require operators to set a long random STARMUS_TUS_WEBHOOK_SECRET and refuse to register the route when it is missing or matches a known default. Fail closed in permissions_check (return WP_Error in the catch). Treat Storage.Path as untrusted: allowlist it under the TUS temp directory, never unlink/move paths outside that directory, and do not take post_id/user_id from webhook metadata without proving the upload session belongs to that user.

• high Vendor OpenPGP private key shipped in the plugin tree and web-accessible

  hardcoded_credentials

  private-backup.asc in the plugin root is a complete -----BEGIN PGP PRIVATE KEY BLOCK----- for 'Max Barrett (Code signing key for Max Barrett / Starisian Technologies) <maximilliantgroup@gmail.com>'. It is included in the GitHub release zip and, on a default WordPress install, is directly fetchable at /wp-content/plugins/starmus-audio-recorder/private-backup.asc because nothing denies access to .asc files. Anyone who can read the plugin (or hit that URL) can impersonate the vendor's code-signing identity. The in-plugin updater (StarmusAudioRecorderUpdater) pulls package URLs from https://updates.starisian.com/v1/info with no signature check, so a stolen signing key plus a compromised or spoofed update channel is a full supply-chain path.

  private-backup.asc:1-43

  Recommendation

  Revoke this key immediately, remove private-backup.asc (and any other key material) from the distributed plugin, and add a web-server deny rule plus a release checklist so private keys never ship. Verify plugin updates with a new key that never leaves the vendor HSM/offline signer.

• high Authenticated upload endpoints overwrite any audio-recording without ownership check

  missing_capability

  REST routes POST /wp-json/star-starmus-audio-recorder/v1/upload-fallback, /upload-chunk, and /upload-chunk-legacy are reachable by any user with upload_files (Author and above; the plugin's intended recorder capability). process_fallback_upload and _finalize_from_local_disk both honor form_data['post_id'] (or recording_id) if get_post_type() is the CPT slug, then replace _audio_attachment_id and, on the TUS/disk path, delete the previous attachment. There is no current_user_can('edit_post') and no author comparison. A logged-in Author who can record audio can therefore replace anyone else's published recording and destroy its media. The same post_id field is accepted from the unauthenticated TUS webhook metadata (see critical finding).

  src/core/StarmusSubmissionHandler.php:413-421,633-636

  Recommendation

  Before attaching to an existing post, require current_user_can('edit_post', $id) (or author match for contributors). Ignore client-supplied post_id on the TUS webhook unless it is bound to a server-side upload session.

• high Non-public audio-recording CPT is listable via REST with ACF PII fields

  information_disclosure

  audio-recording is registered with publicly_queryable false (hidden from the front-end query) but public true and show_in_rest true. create_audio_post always inserts post_status=publish. WordPress REST WP_REST_Posts_Controller::check_read_permission allows unauthenticated reads of published show_in_rest types, so GET /wp-json/wp/v2/audio-recording enumerates every recording (title, author, content, featured media) that the plugin otherwise treats as private. ACF field groups attached to that CPT set show_in_rest => 1, including device fingerprint, environment snapshot, and recording metadata (StarmusPostTypeLoader around the group_starmus_session / environment groups). sparx_contributor, starmus-script, and several other CPTs are likewise show_in_rest true. Consumer is the core REST API; any visitor can harvest contributor recordings and device fingerprints without logging in.

  src/core/StarmusPostTypeLoader.php:4558-4595,2060-2063,2412-2415

  Recommendation

  Set show_in_rest to false on contributor CPTs, or keep it true only with a permission_callback that requires the author or edit_others_posts. Create recordings as private/draft until an editor publishes. Disable show_in_rest on ACF groups that store fingerprints, environment data, or other PII.

• medium Any logged-in user can publish starmus-script posts via admin-post

  missing_capability

  admin_post_starmus_save_script (StarmusProsodyPlayer::handle_post_script) is registered without a nopriv twin, so it requires a login, and it verifies starmus_save_script_nonce. Creating a new script (no script_id) never calls current_user_can; it wp_insert_post with post_type starmus-script and post_status publish as the current user. Subscribers, who cannot publish posts or access this CPT in wp-admin, can therefore inject published script content from the [starmus_add_script_form] shortcode. The CPT is show_in_rest true, so those posts also appear on GET /wp-json/wp/v2/starmus-script. Edit mode does check edit_post, but the create path is ungated beyond is_user_logged_in.

  src/frontend/StarmusProsodyPlayer.php:583-621

  Recommendation

  Require current_user_can('publish_posts') or a dedicated starmus_edit_audio / edit_starmus-scripts capability before insert. Default new scripts to draft. Keep the edit_post check on updates.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.