Update Pilot WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.7.0

Findings

1

Worst severity

medium

Content hash

42beef277070ea0c65a02c93… Copy

Findings

• medium Network settings save has no capability check and writes any registered option group as site options

  missing_capability

  On multisite, settings_page() posts to edit.php?action=update, which loads wp-admin/network/edit.php and fires network_admin_edit_update. Core does not capability-check that file (only auth_redirect); user_can_access_admin_page() allows pagenow=edit.php because it is not a network menu item. Plugin::action_update_network_settings() then check_admin_referer($option_page.'-options') and, with no current_user_can('update_plugins') or manage_network_options, applies allowed_options starting from an empty array. That filter is populated by every register_setting() call on the request (this plugin's keys plus WordPress register_initial_settings() on rest_api_init: blogname, WPLANG, etc., plus other plugins). For each name it update_site_option()s raw POST or delete_site_option()s if the field is absent. A multisite site administrator who can open Settings → General therefore holds a valid general-options nonce and can write or delete those names in sitemeta. Observable consumer: get_locale() reads get_site_option('WPLANG') as the network default locale when a blog has no WPLANG option. Subscribers cannot mint the nonce. Single-site is unaffected (form posts to options.php, which checks manage_options). The handler also never limits option_page to SETTINGS_SLUG, so it is a network-wide Settings API sink rather than this plugin's own save.

  php/class-plugin.php:937-968

  Recommendation

  Require current_user_can('update_plugins') (or manage_network_options) immediately after the nonce check, matching the settings page capability. Reject option_page values other than SETTINGS_SLUG ('update-pilot'). Iterate only this plugin's registered option names, not the global allowed_options list. Prefer wp_safe_redirect after save.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.