Tsjippy News Gallery WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.3.5

Findings

2

Worst severity

high

Content hash

6f9156a68654ad6284abdb39… Copy

Findings

• high Unrestricted file upload via wp_ajax_tsjippy-upload-files (no type validation, path-controllable)

  rce

  The bundled fileUpload module (loaded unconditionally by shared-functionality/loader.php) registers wp_ajax_tsjippy-upload-files -> ajaxUploadFiles(). It requires only login plus a 'file-upload' nonce; when user-id equals the current user no capability beyond being logged in is required. FileUploader::processFiles()/moveFile() move the uploaded file with $wp_filesystem->move() after only sanitize_file_name() on the name — there is NO extension or MIME allow-list and WordPress's wp_handle_upload MIME enforcement is bypassed entirely. A logged-in user served an upload field (the nonce is minted in FileUploadHtml::getUploadHtml) can upload evil.php into wp-content/uploads and execute it = RCE. The target directory is also attacker-influenced: $_POST['file-upload-target-dir'] is used as-is whenever it merely contains the uploads basedir substring, so a value like <basedir>/../../ writes outside the uploads folder. Rated high (authenticated / low-priv arbitrary file write per rubric); becomes critical wherever a below-admin role is shown an upload field.

  shared-functionality/modules/fileUpload/php/fileupload.php:10-70

  Recommendation

  Enforce a strict extension/MIME allow-list (reject php/phtml/etc.), route uploads through wp_handle_upload with 'test_type'=>true, confirm the resolved target path is inside uploads with realpath(), and gate the handler with a real capability.

• medium Target directory traversal allows writing uploads outside the uploads folder

  file_access

  FileUploader::processFiles() only checks str_contains($targetDir, $baseDir); it never canonicalises with realpath, so a caller-supplied file-upload-target-dir containing '..' segments (optionally prefixed with the real basedir to satisfy the substring test) escapes wp-content/uploads. Combined with the missing type check above this widens the write primitive to arbitrary filesystem locations the web user can write.

  shared-functionality/modules/fileUpload/php/classes/FileUploader.php:57-67

  Recommendation

  Resolve the final path with realpath() and verify it is strictly within the uploads basedir before any mkdir/move.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.