REST Likes WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

medium

Content hash

cded64384532d512e4c73922… Copy

Findings

• medium Unauthenticated like/unlike rate limit is bypassed via spoofed X-Forwarded-For

  dos

  POST and DELETE `/wp-json/rest-likes/v1/{posts|comments}/{id}/like` are registered with `permission_callback` `check_permission`, which is intended to let guests like published posts/pages and approved comments. The only built-in brake is a 2-minute transient keyed by `md5(ip + object_id + HTTP method)`. `ip` is `$_SERVER['HTTP_X_FORWARDED_FOR']` when that header is present, otherwise `REMOTE_ADDR`. The entire header value is hashed, so a client can send a unique X-Forwarded-For on every request (including when a reverse proxy appends a real IP) and never hit the existing transient. `add_like`/`remove_like` then `delete_transients` + `set_transient` (allocating a new options-table transient per spoofed key) and `handle_like()` read-modify-writes `_rest_likes` with no locking, no per-user identity, and `max($likes, 0)` so DELETE can zero the counter. This is not RCE/XSS and guest likes are by design; the bug is that the advertised anti-repeat control is fully attacker-controlled, turning a single unauthenticated client into unlimited meta writes and wp_options growth. GET `/like` with `__return_true` only returns the integer count and is not in scope.

  classes/Controller.php:211-234,248-327,384-433

  Recommendation

  Do not trust `X-Forwarded-For` unless it was set by a configured trusted proxy; key the rate limit on `REMOTE_ADDR` (or the rightmost trusted hop). Bound writes (max increment per object per window, shared counter rather than unique transient per spoofed header) and consider a cookie/session like-token so unlike cannot anonymously zero counts. Keep guest likes if that is the product, but make the throttle actually bind to the connection.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.