The Repo WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

1.3.5

Findings

4

Worst severity

high

Content hash

4dc74afe573c255f097b0f25… Copy

Findings

• high Unauthenticated SSRF with GitHub token leakage (get_release_data)

  ssrf

  ajax_get_release_data is registered for wp_ajax_nopriv and passes $_GET['url'] (only esc_url_raw) to fetch_github_data(), which calls wp_remote_get() (not wp_safe_remote_get, no host allowlist) and, when GITHUB_API_TOKEN is defined, sends 'Authorization: token <GITHUB_API_TOKEN>' to that arbitrary URL. Any visitor can (a) exfiltrate the site's GitHub token by pointing url at their own server, (b) make the server issue requests to internal/metadata hosts (partial response read-back via assets[0].browser_download_url / html_url), and (c) fill wp_options with unbounded transients (one per unique URL). The same sink is reachable via subscriber-supplied download_url stored as latest_release_url and fetched by the public REST route the-repo/v1/plugin/<slug> (__return_true).

  functions.php:6-7,93-127,170-205

  Recommendation

  Restrict fetch_github_data to https://api.github.com/ (parse host and compare), use wp_safe_remote_get, only attach the token for api.github.com, and look up the URL server-side from the post instead of accepting it from the request.

• high Subscribers granted upload_files with SVG allowed and MIME content-check bypassed (stored XSS)

  xss_stored

  On every init the plugin adds upload_files (plus edit_posts/publish_posts) to the subscriber role, adds svg => image/svg+xml to upload_mimes (restrict_subscriber_mimes explicitly keeps svg for subscribers), and hooks wp_check_filetype_and_ext to return the extension-based type, disabling WordPress's real-content check. No SVG sanitization exists. Any self-registered subscriber can upload an SVG containing <script> via the media library/async-upload or the submission form's markdown_file upload (handle_image_upload accepts image/svg+xml); the file is served same-origin from /wp-content/uploads/, so opening it (e.g. a link sent to an admin) executes JS in the site origin -> admin session takeover.

  functions.php:10-31,49-66,133-142

  Recommendation

  Do not allow SVG uploads without a sanitizer (e.g. enshrined/svg-sanitize), never override wp_check_filetype_and_ext with extension-only results, and restrict SVG to trusted roles.

• medium Plugin permanently escalates the core subscriber role

  insecure_config

  allow_subscribers_to_edit_own_posts() runs on init and writes edit_posts, edit_published_posts, upload_files and publish_posts into the subscriber role stored in wp_user_roles. Every self-registered user can publish core posts and upload media site-wide; the change persists in the database even after deactivation. This silently widens the attack surface of every other plugin that gates on edit_posts/upload_files.

  functions.php:133-142

  Recommendation

  Use a dedicated custom role with caps mapped to the plugin_repo/theme_repo CPTs only, add caps once on activation and remove them on deactivation.

• low Unauthenticated filter_plugins lists scheduled posts of any post type

  information_disclosure

  wp_ajax_nopriv_filter_plugins sets post_type from $_GET['type'] with post_status ['publish','future'], so ?type=post (or any CPT) returns titles, permalinks and excerpts of scheduled, not-yet-published content.

  includes/ajax.php:4-35

  Recommendation

  Whitelist type to plugin_repo/theme_repo and drop 'future' from the public query.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.