Advanced Product WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.7

Findings

4

Worst severity

high

Content hash

ed5b0dd7dc484997e5ddbfb6… Copy

Findings

• high Unauthenticated sample-data installer with no nonce or capability check

  missing_auth

  Help::install_sample_data is hooked to both wp_ajax_ and wp_ajax_nopriv_ advanced-product/page/help/install-sample-data. The handler never calls current_user_can or wp_verify_nonce (the admin JS sends archive_sort_nonce, but PHP ignores it). It instantiates Advanced_Product\Install and runs import_custom_fields(), import_products(), and create_pages(). Those methods import bundled WXR files into ap_custom_field / ap_product (skipped only if posts of that type already exist) and insert a published Inventory page, writing options_ap_inventory_page_id. The Help submenu itself is registered with manage_options, but that gate is not applied to the AJAX action, so any unauthenticated client can trigger the import.

  core/pages/help.php:25-67

  Recommendation

  Remove the nopriv hook. Require current_user_can('manage_options') and check_ajax_referer() before calling Install::install(). Do not run create_pages() from an unauthenticated context.

• high SQL injection in custom-field and group-field sortable AJAX (Contributor+)

  sql_injection

  ap_post_type_ap_custom_field_archive_sortable and ap_taxonomy_ap_group_field_sortable are registered for both authenticated and nopriv AJAX. After a user-id-scoped nonce check they parse_str($_POST['order']) and interpolate implode(',', $data['post']) / $data['tag'] directly into IN() clauses. IDs are not absint'd. This is numeric-context SQL injection: a payload such as order=post[]=1)+OR+SLEEP(5)-- does not need quotes and is not stopped by wp_magic_quotes. There is no current_user_can. The nonce is localized on edit.php?post_type=ap_custom_field (and the group-field tags screen) because capability_type is 'post', so Contributor+ (edit_posts) receive a usable nonce and can execute SQL. The nopriv registration is unnecessary; unauthenticated callers lack the nonce in practice.

  core/post-types/custom_field.php:44-45,427-451

  Recommendation

  Drop nopriv hooks. Require current_user_can('edit_others_posts') or manage_options. Map the order arrays through array_map('absint', ...) and pass them as prepare placeholders. Apply the same fix to Group_Field::saveAjaxOrder (core/taxonomies/group_field.php lines 22-23 and 216-220).

• high Stored XSS via product custom fields and ap_video (Author+)

  xss_stored

  ap_product uses capability_type 'post', so Authors can publish products and fill ACF fields. Archive/single/quickview templates print field values with echo $f_value, echo $html, and echo the_field() with no wp_kses. ACF text fields default to formatting=html (nl2br only, no htmlspecialchars). When a product has a video and no gallery, templates/single/media/video.php outputs get_field('ap_video') through balanceTags(), which does not strip script or event handlers (the gallery template uses wp_kses(..., 'post') instead). A published payload such as <script> or <img onerror> in a text field or ap_video executes for every visitor of the product, compare modal, and quick view.

  templates/single/media/video.php:9-16

  Recommendation

  Escape text/number custom fields with esc_html(). Run ap_video through wp_kses_post() or allow only oEmbed URLs. Restrict ap_custom_field / configuration CPTs to manage_options rather than capability_type 'post'.

• medium CSRF on product archive permalink option

  csrf

  save_wordpress_settings runs on admin_init whenever $pagenow is options-permalink.php and $_POST['ap_archive_permalink'] is set. It updates option ap_archive_permalink with trim($_POST[...]) and does not verify a nonce or current_user_can. options-permalink.php is admin-only (manage_options), but WordPress processes admin_init before the permalinks form nonce is checked, so a logged-in administrator who is induced to submit a cross-site POST will change the ap_product rewrite slug and break inventory URLs.

  advanced-product.php:807-811

  Recommendation

  Check current_user_can('manage_options') and verify the permalinks form nonce (or check_admin_referer('update-permalink')) before updating ap_archive_permalink. Sanitize the slug with sanitize_title().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.