Medium-severity findings.

Audited release

1.0.0

Findings

2

Worst severity

medium

Content hash

db37cfb6229f1ce855d7cc9e… Copy

Findings

• medium Bundled SimpleTest/php-liquid test and example PHP is unauthenticated and runs exec/ls

  dev_tool_in_production

  The v1.0.2 zip vendors the entire php-liquid repository, including SimpleTest 1.x and example scripts, under a web-accessible plugins path with no index.php or ABSPATH/WPINC guard. An unauthenticated GET to vendor/php-liquid/test/simpletest/test/visual_test.php constructs a TestSuite and runs it (lines 473–494). TestOfVisualShell::testDump calls $this->execute('ls') and execute('dir') then dumpOutput(), which prints the PHP process working-directory listing into an HTML <pre> (information disclosure of plugin/site files). Direct GET to shell_test.php (autorun.php shutdown) execs hardcoded 'echo Hello' and 'blurgh! 2>&1'. GET all_tests.php additionally loads live_test.php (fsockopen to www.lastcraft.com:80) and acceptance_test.php (SimpleBrowser HTTP to http://www.lastcraft.com/test/). GET vendor/php-liquid/test/test.php runs the full Liquid unit suite and dumps paths. Commands are not attacker-controlled (not RCE), but this is production debug surface: unauth exec, outbound connections, CWD listing, and CPU DoS. Remove test/ and example/ from the distributed plugin, or deny PHP execution in those directories.

  vendor/php-liquid/test/simpletest/test/visual_test.php:388-400

  Recommendation

  Do not ship vendor/php-liquid/test, vendor/php-liquid/example, or SimpleTest in the production zip. Keep only the Liquid library files the banner renderer needs. Add index.php silencers (or a deny-PHP .htaccess) under vendor/. If tests must remain for developers, gate them on WP_DEBUG and php_sapi_name()==='cli'.

• low Department title and URL saved unsanitized and echoed unescaped via Liquid

  xss_stored

  uconnbanner_options_validate only checks whether department_title and department_url are the empty string; it does not sanitize_text_field or esc_url_raw. views/public.php passes those values (and get_bloginfo('name')) into LiquidTemplate::render. php-liquid does not auto-escape; LiquidStandardFilters::escape exists but banner.html does not apply it. The template outputs <a href="{{ site.department_url }}">{{ site.department }}</a>, so HTML or javascript: URLs persist into the frontend banner. The admin form also echoes the stored values into input value attributes without esc_attr. Write path is register_setting → options.php with manage_options and a settings_fields nonce, so a Subscriber cannot set the option. On single-site, administrators typically have unfiltered_html already; the practical extra risk is multisite site admins (manage_options, often no unfiltered_html) or defense-in-depth if an admin session is abused. Not a below-admin stored-XSS.

  views/public.php:21-34

  Recommendation

  In uconnbanner_options_validate, sanitize department_title with sanitize_text_field and department_url with esc_url_raw. Escape on output (esc_html / esc_url) before passing assigns into Liquid, or apply Liquid escape filters in banner.html. Echo stored values in views/admin.php with esc_attr.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.