Delete Inactive Users WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

high

Content hash

cceca88e7d5a6d274f201aa9… Copy

Findings

• high Missing capability on AJAX mass user deletion (any role, including administrators)

  missing_capability

  diu_prepare_deletion and diu_process_batch are hooked only to wp_ajax_* (any logged-in user). Each callback begins with check_ajax_referer('diu_delete_users','nonce') and then performs privileged work with no current_user_can('manage_options') or current_user_can('delete_users'). Nonce verification is CSRF protection for a named action, not authorization: wp_create_nonce('diu_delete_users') is valid for whatever uid is in the session, including Subscriber/customer. prepare_deletion takes $_POST['user_role'] (sanitize_text_field only — not intersected with get_editable_roles(), not blocked for administrator/shop_manager) and queues matching IDs in the site-wide transient diu_user_ids_to_delete. The query ORs last_login NOT EXISTS with last_login < cutoff; last_login is written only by this plugin on wp_login as a unix timestamp while the query compares DATETIME, so NOT EXISTS matches every user of that role who has not re-logged-in since activation — i.e. an attacker can wipe an entire role, not merely 'inactive' accounts. process_batch then wp_delete_user()s 50 IDs per request with no reassignment, no skip of ID 1, and no skip of the current user. Observable: administrators vanish from wp_users and their posts are deleted, leaving the site with no remaining admin. The manage_options gate on add_submenu_page does not apply to admin-ajax.php.

  delete-inactive-users.php:190-265

  Recommendation

  At the top of both AJAX callbacks, require current_user_can('delete_users') (and manage_options if this should stay a Tools admin utility) in addition to the existing nonce check. Refuse user_role values that are not in get_editable_roles(), and never delete administrators, user ID 1, or get_current_user_id(). Key the transient per user (or use a user meta / private option) so one session cannot drain another. Align last_login storage with the DATETIME comparison (store current_time('mysql') or compare as NUMERIC timestamp) so the inactivity filter actually applies.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.