WPLoyalty - Migration WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

high

Content hash

c9d90b570d143693df7f018c… Copy

Findings

• high Unauthenticated access to exported customer CSVs in the plugin directory

  information_disclosure

  handleExport() (wp_ajax_wlrmg_handle_export) is capability-and-nonce gated, but it materializes the export as static files under WLRMG_PLUGIN_DIR/App/File/{job_id}/ with chmod 0777, then exportFileList() advertises them as WLRMG_PLUGIN_URL/App/File/{job_id}/{name}.csv. There is no download handler, no auth cookie check, and no .htaccess/nginx deny — Apache/nginx serve the CSV to anyone who requests the URL. Columns are user_email, referral_code, and points for every migrated customer. job_id is an 8-character hex suffix of md5(uniqid()), stored as VARCHAR(8); filenames are a fixed prefix (wc_|wlr_|wpswing_|customer_) plus _customer_migration_export_{n}.csv. App/File/index.html only covers the parent folder; newly mkdir'd job folders have no index, so directory indexes (when enabled) list every part file. exportPopup() also chmod 0777 the File directory if it is not writable. job_id is concatenated into the filesystem path after sanitize_text_field only (no basename/realpath), so the same handler can write CSVs outside App/File/ if a manage_woocommerce user supplies ../. Fix: write to wp-content/uploads with a random name outside the web-reachable tree or stream via admin-post with manage_woocommerce + nonce; add deny rules; never chmod 0777; canonicalize job_id.

  App/Controller/Migration.php:288-324,409-495,585-592

  Recommendation

  Do not store PII CSVs under the plugin directory. Stream the export through an authenticated admin-post/AJAX callback that checks manage_woocommerce and a nonce, or write to a randomized path in wp-content/uploads that is blocked from direct HTTP (or deleted immediately after download). Validate job_id against the scheduled-job uid charset and resolve the realpath inside App/File. Add an Apache/nginx deny-all for App/File. Use 0750/0755, never 0777. Lengthen generateUuid() beyond 8 hex characters if it remains part of any URL.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.