TBWorks - Mothership Tracking WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.8

Findings

3

Worst severity

high

Content hash

7021aba22e51dbe9cafc418e… Copy

Findings

• high Tracking JSON endpoint leaks site inventory when secret empty or weak

  information_disclosure

  Public query-var endpoint tbw_tracking.returnTracking returns plugin list, versions, update status, and Akeeba backup paths when key equals md5(stored secret). Empty secret yields well-known md5('')=d41d8cd98f00b204e9800998ecf8427e, enabling unauthenticated information disclosure.

  tbw_tracking.php:163-218

• medium Admin settings save lacks nonce

  missing_nonce

  print_MothershipTracking_management updates tbw_mothership_tracking_secret on POST with manage_options check but no nonce, enabling CSRF to set/clear the tracking secret.

  tbw_tracking.php:111-128

• low Tracking auth uses md5 of secret as bearer

  predictable_token

  Access control is key==md5(secret) with maxlength 24 secret — predictable/weak token design versus HMAC.

  tbw_tracking.php:210-216

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.