High-severity findings.

Audited release

10.8.1

Findings

3

Worst severity

high

Content hash

27df9cc54ade2537e00122b7… Copy

Findings

• high Unauthenticated open redirect via mailtracker REST url parameter

  unsafe_input

  mailTracker is registered with permission_callback __return_true. When the url query/param is present it urldecodes the value and calls wp_redirect($url) without validating it is an allowed same-site destination. Unauthenticated attackers can craft tracking links that bounce victims through the site to arbitrary external URLs.

  php/rest_api.php:74-121

  Recommendation

  Allow only relative paths or URLs under home_url(); use wp_safe_redirect. Keep tracking public if needed but never redirect to attacker-controlled absolute URLs.

• high Reflected XSS via unsanitized listtype on public show_children REST

  xss_reflected

  show_children uses permission_callback __return_true and passes request params into displayChildren. When listtype is set, the value is interpolated into an HTML attribute: str_replace("<li", "<li style='list-style-type: {$attributes['listtype']}'", $html) without escaping. An unauthenticated POST can break out of the attribute and inject event handlers/script.

  shared-functionality/blocks/blocks.php:143-144

  Recommendation

  Sanitize listtype against an allowlist of CSS list-style-type keywords and escape with esc_attr. Prefer authenticated permission_callback for the REST route.

• low Public mailfailed REST echoes request parameters (debug surface)

  unnecessary_attack_surface

  mailfailed is registered with WP_REST_Server::ALLMETHODS and permission_callback __return_true; the callback returns $wpRestRequest->get_params() with a comment that it is for testing. Unnecessary public attack surface / information disclosure.

  php/rest_api.php:29-50

  Recommendation

  Remove the test endpoint or restrict it to administrators in production builds.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.