Critical findings.

Audited release

2.1.0.1

Findings

3

Worst severity

critical

Content hash

3c4b0bb926079038aed5c2c6… Copy

Findings

• critical Unauthenticated PHP object injection via geot_ajax menu_filter

  object_injection

  wp_ajax_nopriv_geot_ajax reads $_POST['geots'][*]['action'] and, if method_exists on the Ajax class, invokes it. menu_filter does unserialize(base64_decode($geot['filter'])) on attacker-supplied input with no auth or integrity check. This is unauthenticated object injection / potential RCE depending on available gadgets.

  includes/class-geotarget-ajax.php:63-81

  Recommendation

  Do not unserialize user input. Use json_decode with a fixed schema, or verify an HMAC over server-rendered filter blobs. Whitelist allowed actions explicitly.

• high Stored XSS via forbidden_text rendered with jQuery.html

  xss_stored

  Post geot_options['forbidden_text'] is saved from $_POST['geot'] (edit_post) without HTML hardening. geot_ajax returns it as posts.hide[].msg and public JS does $("...entry-content").html("<p>"+msg+"</p>"), executing attacker HTML/JS for site visitors when geo-hiding triggers.

  includes/class-geotarget-ajax.php:326-335

  Recommendation

  Sanitize forbidden_text with wp_kses_post on save; escape on output; prefer textContent/jQuery.text or a safe templating path instead of .html().

• medium Dynamic method dispatch from unauthenticated AJAX action parameter

  unsafe_input

  geot_ajax uses method_exists($this, $geot['action']) then $this->{$geot['action']}($geot) for any private method on the class (including getDebugInfo). Amplifies attack surface for unauthenticated callers.

  includes/class-geotarget-ajax.php:68-76

  Recommendation

  Whitelist allowed action names (country_filter, city_filter, etc.) instead of method_exists.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.