Ielko WP Media Manager WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.4

Findings

3

Worst severity

high

Content hash

d876a62aeb56605ae3bf651a… Copy

Findings

• high Unauthenticated checkdead feed updates media_active meta

  missing_auth

  Public feed `checkdead` (`checkDeadFunc`) iterates media_item posts, probes stored URLs, and updates `media_active` via `update_post_meta` with no auth. Unauthenticated callers can force re-checks and flip active flags that control which streams appear in device feeds (DoS / availability manipulation).

  ielko-wp-media-manager.php:749-784

  Recommendation

  Restrict checkdead to cron/admin with a capability check or shared secret; never expose as a public feed.

• high Unauthenticated gen_img feed reads attacker-controlled filesystem path

  file_access

  `genimg_f` (feed `gen_img`) passes unsanitized `$_GET['orig']` into `imagecreatefrompng($orig)` when set. Unauthenticated users can force PHP to open arbitrary local paths (PNG-readable files) and receive processed image output, enabling local file access / path traversal. Remote URLs may also be reachable if allow_url_fopen is enabled (SSRF).

  ielko-wp-media-manager.php:393-420

  Recommendation

  Do not accept filesystem paths from the request. Resolve images only from an allowlisted uploads subdirectory or attachment IDs with authorization.

• high SSRF via remotefeed URL fetch in remoteupdate

  ssrf

  Alongside missing auth, `$_GET['remotefeed']` is passed to `file()` and `file_get_contents` with no host allowlist, enabling server-side request forgery against internal network services when the unauthenticated feed is hit.

  ielko-wp-media-manager.php:661-685

  Recommendation

  Validate URLs against an allowlist of schemes/hosts; prefer wp_remote_get with timeout and block private IP ranges.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.