UIPro WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ #10 in Page Builder Addons

High-severity findings.

Audited release

1.1.5

Findings

2

Worst severity

high

Content hash

d4f3ce51daa83ddb09caa0eb… Copy

Findings

• high Unauthenticated WP_Query injection via base64-encoded AJAX query JSON

  information_disclosure

  The same nopriv loadmore handlers decode $_POST['query'] and pass the resulting array to get_posts() or new WP_Query() after only overwriting post_status with 'publish' (and paged). An unauthenticated client therefore controls post_type, posts_per_page, post__in, meta_query, tax_query, author, s, and every other WP_Query argument except status. get_posts() does not honor publicly_queryable, so this dumps titles, excerpts, permalinks, and thumbnails of any published post type the templates render — including types never exposed on the front end and, when WooCommerce is present, shop_coupon posts (coupon codes are post_title). meta_query becomes a boolean oracle for unpublished-looking meta on published posts. posts_per_page=-1 is an unauthenticated database DoS. templaza_ui_ap_products_filter additionally copies $_POST['filter_by'] / filter_value straight into tax_query. Duplicate get_posts paths exist on the Elementor widget classes (widgets/uiposts/class-el-uiposts.php:65-71, widgets/uigallery/class-el-uigallery.php:54-60, widgets/uiadvancedproducts/class-el-uiadvancedproducts.php:71-77), and class-el-uiadvancedproducts registers its nopriv hook as templaza_ui_post_loadmore (wrong action name), so a single unauth post-loadmore request can run both widgets' handlers.

  widgets/uiposts/ajax.php:22-26

  Recommendation

  Never accept WP_Query from the client. Persist a widget/document ID (and page number) and reconstruct a strict allow-listed query server-side (post_type, posts_per_page cap, taxonomy terms). Ignore unknown keys. Repeat for widgets/uiadvancedproducts/ajax.php (loadmore and filter) and the class-el-* duplicates. Cap posts_per_page.

• medium Subscriber autocomplete AJAX has no capability or nonce and dispatches on source_type

  missing_capability

  UIAutoComplete is instantiated from UIPro_El::load_controls() on every request when Elementor is active. ui_get_autocomplete_suggest and ui_get_autocomplete_render are wp_ajax_ only (any logged-in user, including Subscriber) and never call current_user_can or check_ajax_referer. They call_user_func_array('UIPro\Elementor\Control\Helper\UIAutoComplete_Helper::' . $_POST['source_type'] . '_callback'|'_render', [$_POST['source'], $_POST['term']]). post_type_callback runs get_posts with attacker-controlled post_type, posts_per_page=-1, and s=term, then returns every matching ID/title/slug as JSON. For post_type=attachment WordPress defaults post_status to inherit, so a Subscriber enumerates the entire media library. taxonomy_callback runs a prepared LIKE against any attacker-chosen taxonomy. The Elementor editor JS never sends a nonce. Method dispatch is limited to Helper::*_{callback,render}, so this is not arbitrary PHP execution, but it is a missing-authorization information leak from a control that should be editor-only.

  controls/uiautocomplete/uiautocomplete.php:40-41,148-181

  Recommendation

  Require current_user_can('edit_posts') (or Elementor's editor capability) and check_ajax_referer. Whitelist source_type to post_type|taxonomy and source to known public types. Cap posts_per_page. Do not concatenate request data into a call_user_func_array target; use an explicit switch.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.