trks.it for WordPress WP Registry grade F. Critical findings · 5 findingsWP RegistryCritical findings · 5 findingsOpen the reportF

Critical findings.

Audited release

1.2

Findings

5

Worst severity

critical

Content hash

005e5bba5f99e68605f9f83f… Copy

Findings

• critical Hardcoded API signature forced in trksit_go.php disables redirect auth

  auth_bypass

  trksit_go.php loads WordPress via SHORTINIT and then overwrites $_GET['api_signature'] with the hardcoded value testing12345678 before comparing it to the same hardcoded $api_signature. Any unauthenticated visitor can invoke the redirect/hit-tracking logic for arbitrary url_id values; the intended API signature check is permanently bypassed (comments even say 'KILL NEXT LINE TO SECURE').

  trksit_go.php:20-31

  Recommendation

  Remove the forced assignment, store a high-entropy signature in options or use HMAC of url_id with wp_salt, and fail closed when the signature is missing or mismatched.

• critical Unauthenticated SQL injection via url_id in trksit_go.php

  sql_injection

  After the hardcoded signature bypass, $_GET['url_id'] is concatenated directly into SELECT queries against trksit_urls, trksit_scripts_to_urls, trksit_scripts, and trksit_hits without absint(), prepare(), or quoting. This is a numeric-context injection (magic quotes do not stop OR/UNION/SLEEP payloads). An unauthenticated attacker can extract DB data and, via UNION, control fields later echoed into HTML/JS (destination_url, meta_*, scripts).

  trksit_go.php:33-52

  Recommendation

  Cast url_id with absint() and use $wpdb->prepare() for every query. Treat all DB fields as untrusted when rendering.

• critical Unauthenticated XSS/script execution via unsanitized redirect page output

  xss_stored

  trksit_go.php echoes destination_url into a meta refresh and JavaScript, echoes meta_title/description/image and Open Graph values without escaping, and echoes custom scripts from trksit_scripts with only stripslashes. Combined with the auth bypass and SQLi, an unauthenticated attacker can force visitor browsers to execute attacker-controlled JavaScript (stored/reflected XSS and intentional script sink).

  trksit_go.php:105-208

  Recommendation

  Escape all HTML/JS contexts (esc_url, esc_html, esc_js). Do not allow arbitrary script storage, or restrict script output to a vetted allowlist executed only after admin review.

• high Direct wp-load.php bootstrap (SHORTINIT) exposes standalone attack surface

  file_access

  trksit_go.php requires ../../../wp-load.php under SHORTINIT, bypassing normal plugin bootstrap/capability checks and creating a stable unauthenticated endpoint under the plugins directory. This amplifies the signature bypass and SQLi above and is a classic high-risk direct-access pattern.

  trksit_go.php:9-11

  Recommendation

  Route redirects through a front-controller rewrite or admin-post/REST handler with proper auth, and deny direct HTTP access to plugin PHP files.

• medium Unsafe unserialize of og_data from database on redirect page

  unsafe_unserialize

  og_data from the trksit_urls row is passed to unserialize() before being echoed into meta tags. With SQLi controlling the selected row, this is an object-injection primitive; even without a POP chain it is unsafe handling of DB content on an unauthenticated page.

  trksit_go.php:123-129

  Recommendation

  Store OG data as JSON and decode with json_decode(); never unserialize untrusted data. Escape keys/values on output.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.