High-severity findings.

Audited release

1.5.3

Findings

1

Worst severity

high

Content hash

41c3dde6aedc5ea3d813214f… Copy

Findings

• high Subscriber+ unauthorized widget import to stored XSS via wp_ajax_import_widget_data (CVE-2020-36769)

  xss_stored

  wp_ajax_import_widget_data is registered for every logged-in user. ajax_import_widget_data() performs no current_user_can('manage_options') (or any cap) and never calls wp_verify_nonce / check_ajax_referer, even though the Tools import form prints a nonce for action import_widget_data. import_file is taken from $_POST and passed straight to file_get_contents() with no realpath/uploads restriction, so when allow_url_fopen is On (PHP default) a Subscriber can point it at a remotely hosted JSON export; local paths and URL wrappers are also accepted. The JSON is decoded and parse_import_data() calls update_option('sidebars_widgets') and update_option('widget_'.$title, $content) for attacker-chosen widget types/instances, bypassing WP_Widget::update() sanitization. Optional clear_current empties every sidebar via clear_widgets(). Observable: a crafted text/custom_html (or any) widget with a <script> title is stored in widget_* and echoed unsanitized by core widget() on the front end (before_title.$title.after_title) and by export_settings_page in wp-admin. The manage_options Tools UI is not required and is not a gate on this AJAX action. Unauthenticated callers cannot hit wp_ajax_ (no nopriv), but the missing nonce allows CSRF of any logged-in session. Unpatched; plugin removed from wordpress.org in April 2020 after Wordfence disclosure. embargoed is false because CVE-2020-36769 has been public since 2020.

  class-widget-data.php:17,353-401

  Recommendation

  In ajax_import_widget_data call check_ajax_referer('import_widget_data') and current_user_can('manage_options') before any read or write. Refuse import_file values that are URLs or that are not a file previously uploaded by wp_handle_upload into the uploads directory (compare realpath against wp_get_upload_dir()['basedir']). Sanitize widget instance data through the registered widget's update() method instead of writing raw JSON into widget_* options. Verify the export_widget_settings nonce that is already printed. Until a patch exists, deactivate and delete the plugin (no patched release; removed from wordpress.org).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.