Tsjippy Positional Account WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

10.7.7

Findings

1

Worst severity

high

Content hash

63de433c7f4fcd7fde32d6ce… Copy

Findings

• high Shared file-upload AJAX accepts any file type, an arbitrary target directory and an arbitrary callback

  file_access

  ajaxUploadFiles() (wp_ajax_tsjippy-upload-files) passes POSTed settings straight to FileUploader. processFiles() moves each uploaded file with WP_Filesystem::move() after only sanitize_file_name(), with no wp_check_filetype/allowed-mime check, so .php files are kept. targetDir comes from $_POST['file-upload-target-dir'] and is only prefixed with the uploads base dir when it doesn't already contain it, so '../' segments escape uploads. It then runs call_user_func($settings['callback'], $userId) with a caller-chosen callable. The gate is is_user_logged_in plus the user-bound 'file-upload' nonce. The plugin itself only issues that nonce inside its own upload HTML, but sibling Tsjippy plugins that share this always-loaded library render it for ordinary users. Anyone holding it can get remote code execution.

  shared-functionality/modules/fileUpload/php/fileupload.php:11-48

  Recommendation

  Validate files with wp_check_filetype_and_ext against an allowlist (or use wp_handle_upload), confine targetDir with realpath() under uploads, drop the client-supplied callback (or map it to a server-side allowlist), and add a capability check such as upload_files.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.