Wetory Support WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.0

Findings

3

Worst severity

high

Content hash

f89a14fe15926c83e2b07ac4… Copy

Findings

• high Unauthenticated AJAX WP_Query injection and template include

  missing_auth

  Wetory_Support_Ajax::register_handlers binds handle_wetory_ajax_loadmore and handle_wetory_ajax_filter to wp_ajax_nopriv_*. Both decode $_POST['query'] JSON into new WP_Query($query) with no allowlist, enabling disclosure of private/draft/password posts. $_POST['template'] is passed to get_template_part(); locate_template only ltrims leading slashes and concatenates onto theme/plugin template paths, allowing ../ traversal to include attacker-chosen .php under the web tree.

  includes/class-wetory-support-ajax.php:24-74,85-129

  Recommendation

  Remove nopriv for these handlers or require a public nonce tied to shortcode context; allowlist query args and post_status=publish; allowlist template names with basename() only.

• high Maintenance page create/delete AJAX missing capability and nonce

  missing_capability

  wetory_create_maintenance_page / wetory_delete_maintenance_page are wp_ajax_* only (any logged-in user) with no check_ajax_referer or current_user_can. They write or unlink WP_CONTENT_DIR/maintenance.php (fixed template content). Any Subscriber can create or remove the site maintenance drop-in; CSRF applies as well.

  includes/wetory-support-functions-ajax.php:66-92

  Recommendation

  Require manage_options and a nonce; do not expose file write via AJAX to low-privilege users.

• medium Post search AJAX missing nonce and capability

  missing_capability

  wetory_search_posts_for_options is wp_ajax_* with no nonce/capability and queries post_type=any for $_GET['q'], returning IDs/titles to any logged-in user.

  includes/wetory-support-functions-ajax.php:28-54

  Recommendation

  Restrict to edit_posts (or relevant CPT caps) and verify a nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.