Medium-severity findings.

Audited release

1.0.3

Findings

2

Worst severity

medium

Content hash

ec404199ca0ddec0ff48a2ef… Copy

Findings

• medium Client IP derived from spoofable forwarding headers

  insecure_config

  LimitLoginAttempts reads REMOTE_ADDR then overwrites from common proxy headers (e.g. HTTP_X_FORWARDED_FOR) without trusting only a configured proxy. Attackers can rotate forged client IPs to bypass attempt counters/blocks or poison ban lists.

  wp-limit-login-attempts-plugin.php:152-175

  Recommendation

  Only honor forwarded headers when behind a known reverse proxy; take the correct hop; validate IP format.

• medium 2FA secret delete/regenerate uses wp_verify_nonce without action

  missing_nonce

  handle_secret_delete and handle_secret_regeneration call wp_verify_nonce($_POST['nonce']) with no action argument, weakening CSRF binding. Delete allows any user who can edit_user($id) to remove another user's totp_secret if they obtain a generic nonce.

  TwoFactorAuthorisation.php:195-220

  Recommendation

  Use check_ajax_referer with a dedicated action; require manage_options to delete another user's 2FA secret.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.