VK Super Global Navigation WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.10

Findings

1

Worst severity

medium

Content hash

47c959fb793c5064b67bdaeb… Copy

Findings

• medium Hardcoded GitHub fine-grained PAT shipped for Plugin Update Checker

  hardcoded_credentials

  vk-super-global-navigation.php constructs a Plugin Update Checker against the public vektor-inc/vk-super-global-navigation GitHub repo, calls enableReleaseAssets(), then setAuthentication() with a plaintext github_pat_ fine-grained personal access token. GitHubApi::getAuthorizationHeader() sends that secret as HTTP Basic (username vektor-inc) on every api.github.com request; setUpdateDownloadHeaders() also attaches it when WP downloads a release asset. The repo is public, so a token is unnecessary for reads. The same string is in the public GitHub tree and every 1.1.10 zip, so anyone can copy it without a WordPress account. A live token with contents:write (or release-asset write) would let an attacker publish a higher tag that PUC injects into the update_plugins site transient, turning auto-update into supply-chain RCE on every install. Empirically, as of this audit GitHub responds 401 Bad credentials for this PAT (likely expired or auto-revoked by secret scanning after the public push), so this specific secret cannot currently be used. The defect remains: credentials do not belong in a distributed plugin, isAuthenticationEnabled() is still true (non-empty string) so PUC prefers authenticated asset URLs that will fail, and this file's git history shows the vendor previously committed classic ghp_ tokens in the same setAuthentication() call.

  vk-super-global-navigation.php:21-28

  Recommendation

  Revoke this PAT (and any prior ghp_/github_pat_ values from git history) on GitHub. Remove setAuthentication() for this public repository so PUC uses unauthenticated releases/latest and browser_download_url. Do not ship GitHub tokens in plugin zips; if a private repo is required, use a fine-grained token that is not distributed (e.g. defined only in the vendor's update proxy) scoped to contents:read on that single repo. Verify release assets (checksum) before offering them as plugin updates.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.